Search vulnerabilities

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2026-126323

Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126369

Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass

Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126370

Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save

Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126371

Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126372

Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code

Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126373

Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126374

Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126375

Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.

CVSS 4.0 · 7.2 High EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126376

Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets

Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126377

Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()

Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126378

Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126379

Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding

Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126380

Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.

CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126381

n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key

n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.

CVSS 4.0 · 4.9 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126382

n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset

n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accepts a new webhook verification secret from any request carrying an X-Hook-Secret header. Unauthenticated attackers who know the webhook URL can replace the secret, send forged Asana events that pass signature verification, and trigger workflows with attacker-controlled data while genuine deliveries are rejected.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126383

n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming items. Attackers who can supply untrusted input, such as a webhook body, to a workflow using these operations can make the node match and overwrite unintended documents or insert new documents in the MongoDB database.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126384

n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted untrusted images to an Edit Image workflow, such as one fed by a Webhook node, can execute code on the n8n instance.

CVSS 4.0 · 7.7 High EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126385

n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback

n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.

CVSS 4.0 · 4.8 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126386

n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration

n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerability in the unauthenticated MCP OAuth dynamic client registration flow, which accepts arbitrary redirect_uri values via the /mcp-oauth/register endpoint. Attackers can send victims crafted /mcp-oauth/authorize URLs that redirect them to attacker-controlled sites before instance checks run, enabling phishing.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126387

n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool

n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright read files such as instance configuration from the n8n server and retrieve their contents from the page.

CVSS 4.0 · 6 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n