Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 6.5 CVE-2026-54310

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes_CVE-2026-54310

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows...

n8n-io n8n >= 2.26.0, < 2.26.2 CVE
HIGH 8.8 CVE-2026-54309

n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions_CVE-2026-54309

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoi...

n8n-io n8n >= 2.26.0, < 2.26.2 CVE
MEDIUM 6.8 CVE-2026-54303

n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints_CVE-2026-54303

n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query par...

n8n-io n8n < 2.24.0 CVE
HIGH 7.1 CVE-2025-62180

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs._CVE-2025-62180

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain...

Pegasystems Pega Infinity 8.3.0 CVE
LOW 3.5 CVE-2025-15619

HCL Connections is vulnerable to broken access control_CVE-2025-15619

HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.

HCLSoftware Connections 7.0, 8.0 CVE
MEDIUM 5.4 CVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename_CVE-2026-8378

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoi...

Unknown Frontend File Manager Plugin CVE
HIGH 7.1 CVE-2026-8172

Simple Basic Contact Form <= 20250114 - Reflected XSS_CVE-2026-8172

The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form outp...

Unknown Simple Basic Contact Form CVE
HIGH 8.8 CVE-2026-8163

Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter_CVE-2026-8163

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, lead...

Unknown Infility Global CVE
MEDIUM 6.8 CVE-2026-7842

Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter_CVE-2026-7842

The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in...

Unknown Infility Global CVE
HIGH 7.2 CVE-2026-56784

OpenRemote Manager – Cross-Tenant IDOR in Bulk Alarm Deletion_CVE-2026-56784

OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated ...

openremote openremote CVE