Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 501–520 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:51.136Z. Updated 2026-10-28T18:59:51.136Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118678

n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which the periodic history compaction ta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 501 to 520 of 16156.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:50.449Z. Updated 2026-10-28T18:59:50.449Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118677

n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted n8n-computer-use:// lin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:49.747Z. Updated 2026-10-28T18:59:49.747Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118676

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:49.071Z. Updated 2026-10-28T18:59:49.071Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:48.389Z. Updated 2026-10-28T18:59:48.389Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118649

n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:47.664Z. Updated 2026-10-28T18:59:47.664Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118648

n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:46.959Z. Updated 2026-10-28T18:59:46.959Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118647

n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:46.290Z. Updated 2026-10-28T18:59:46.290Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob patterns. Attackers who can create and run workflows can submit a wildcard-heavy File(s) Selector pattern causing exponential backtracking, mak…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:45.637Z. Updated 2026-10-28T18:59:45.637Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118645

n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:44.935Z. Updated 2026-10-28T18:59:44.935Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118644

n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:44.266Z. Updated 2026-10-28T18:59:44.266Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118643

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, M…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:41.954Z. Updated 2026-10-28T18:59:41.954Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118642

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:40.775Z. Updated 2026-10-28T18:59:40.775Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118641

n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrust…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:40.104Z. Updated 2026-10-28T18:59:40.104Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

MedPublished 29 Oct 2026, 01:59 WIB

CVE-2026-118640

n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the global:chatUser role can add and run tools through chat to execute sandboxed code, access permitted files, and use instance workflows, Data Tab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:59:39.419Z. Updated 2026-10-28T18:59:39.419Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:59 WIB

Official record

HighPublished 29 Oct 2026, 01:58 WIB

CVE-2026-118261

Echo: Decompress permits unbounded gzip expansion in v4

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:58:43.504Z. Updated 2026-10-28T18:58:43.504Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:58 WIB

Official record

HighPublished 29 Oct 2026, 01:56 WIB

CVE-2026-118260

Echo: BodyDump captures request and response bodies without size limits in v4

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:56:56.747Z. Updated 2026-10-28T18:56:56.747Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:56 WIB

Official record

MedPublished 29 Oct 2026, 01:53 WIB

CVE-2026-118259

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceContextPropagator.extract() uses regex delimiter processing that can exhibit quadratic backtracking while parsing tracestate headers containing lon…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:53:25.875Z. Updated 2026-10-28T18:53:25.875Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:53 WIB

Official record

CritPublished 29 Oct 2026, 01:45 WIB

CVE-2026-118633

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be insta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:45:59.892Z. Updated 2026-10-28T18:45:59.892Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:45 WIB

Official record

LowPublished 29 Oct 2026, 01:33 WIB

CVE-2026-118258

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a te…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T18:33:30.672Z. Updated 2026-10-28T18:33:30.672Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:33 WIB

Official record