CVE Vulnerabilities - 10 October 2026

The SiteVault backup, restore, migration and cloning plugin for WordPress (versions up to 1.5.18) can be tricked into executing malicious code on your server. This could let an unauthorized person tak...

The n8n automation tool contains a weakness that could let a malicious user start or change workflows without permission. The problem is fixed in versions released after 2.28.0-r4. Upgrade n8n to the ...

The n8n workflow automation tool includes the vm2 library version 3, which has a weakness that can let an attacker run their own code inside your system. This could lead to unauthorized actions or dat...

The n8n automation platform includes an older version of the vm2 component, which can allow someone to cause the system to execute unauthorized code. This could let an attacker manipulate workflows or...

The n8n workflow automation tool uses the vm2 library version 3 or later, which contains a weakness that could let an attacker cause the system to run code it shouldn't. This could lead to data exposu...

The n8n workflow automation tool includes a component called vm2 that, in versions before 3, can be bypassed to run code outside its intended sandbox. This could let an attacker execute commands on yo...

The n8n workflow automation tool uses the vm2 library, and versions of vm2 older than 3 contain a weakness that could let a malicious user execute code outside the intended sandbox. This could let an ...

The n8n workflow automation tool includes the vm2 library version 3 or later, which can be tricked into executing code that it should block. This means an attacker could run arbitrary commands on the ...

The n8n workflow automation tool includes the vm2 library version 3, which has a security weakness that could allow an attacker to run code on the server hosting n8n. This could lead to data exposure ...

The n8n workflow automation tool includes the vm2 component, which has a weakness that could let an attacker run arbitrary code on the server hosting n8n. This could lead to data loss or further compr...

The Creator LMS plugin for WordPress (versions up to 1.2.21) lets a user with contributor rights place any file on your server. This could let an attacker add malicious code or steal data. Update the ...

The CodeBard Help Desk plugin (versions up to 1.1.2) allows users with the lowest permission level to place any file on the server. An attacker could upload malicious code and take control of the webs...

The n8n workflow automation software uses the vm2 component, which has a security weakness that could let a malicious user execute arbitrary code on the system. This could compromise data or disrupt o...

The n8n workflow automation tool includes the vm2 library up to version 3, which can be tricked into running attacker‑supplied code. This could let a bad actor cause the system to perform unauthorized...

The n8n workflow application includes the vm2 library version earlier than 3, which can be tricked into executing code that an attacker supplies. This could let a malicious user run commands on your s...

The n8n workflow automation tool includes the vm2 component version 3 or newer. That component can allow a malicious user to cause n8n to run unwanted code, potentially compromising your system. Upgra...

The n8n automation tool from cleanstart can be tricked into executing code it shouldn’t. This could let an attacker run commands on your server, potentially compromising data or services. Update to th...

The n8n workflow tool includes vm2 version 3, which has a flaw that can let specially crafted code escape its safe environment and run on the host system. This could allow attackers to run commands or...

Websites that use the Buzz Stone magazine and viral blog theme version 1.0.2 or earlier can be accessed by anyone on the internet to inject malicious data that runs on the server. This can let an atta...

The Photolia theme for WordPress (versions up to 1.0.3) lets anyone send specially crafted data that can cause the server to execute unwanted code. This could let attackers take control of your websit...

The Qwery theme for WordPress (versions up to 3.6.1) can be accessed by anyone on the internet to send specially crafted data that makes the server run unwanted code. This could let an attacker take c...

The Jacqueline theme for WordPress, version 2.22 and earlier, can be tricked into executing code without any login. This could let an attacker take control of your website or steal data. Update the th...

The Alliance theme for WordPress (versions up to 3.11) can be tricked by anyone on the internet to run their own code on your site. This could let an attacker take over the website or steal data. Upda...

The Kicker theme (versions up to 2.2.1) can be tricked by anyone on the internet into running their own code on your WordPress site. This could let an attacker gain control of the site or steal data. ...

The Original theme for WordPress (versions up to 1.9.0) can be tricked by anyone on the web into inserting harmful data, which may let an attacker execute code on your site. This could compromise your...