CVE-2026-54052 — Critical vulnerability brief
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP…
Tag: Critical CVE
CVE-2026-53512 — Critical vulnerability brief
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token…
CVE-2026-56400 — Critical vulnerability brief
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers…
CVE-2026-48284 — Critical vulnerability brief
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current…
CVE-2026-48319 — Critical vulnerability brief
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary…
CVE-2026-48358 — Critical vulnerability brief
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the…
CVE-2026-45063 — Critical vulnerability brief
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12,…
CVE-2026-62390 — Critical vulnerability brief
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog…
CVE-2026-62392 — Critical vulnerability brief
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring…
CVE-2026-58319 — Critical vulnerability brief
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE…