Security advisories

medium2026-02-25

CVE-2026-27116-Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module

go-vikunja/vikunja · GHSA-4qgr-4h56-8895

critical2026-02-25

CVE-2026-27498-n8n has Arbitrary Command Execution via File Write and Git Operations

n8n-io/n8n · GHSA-x2mw-7j39-93xq

critical2026-02-25

CVE-2026-27497-n8n has Potential Remote Code Execution via Merge Node

n8n-io/n8n · GHSA-wxx7-mcgf-j869

critical2026-02-25

CVE-2026-27495-n8n has a Sandbox Escape in its JavaScript Task Runner

n8n-io/n8n · GHSA-jjpj-p2wh-qf23

high2026-02-25

CVE-2026-27494-n8n has Arbitrary File Read via Python Code Node Sandbox Escape

n8n-io/n8n · GHSA-mmgg-m5j7-f83h

critical2026-02-25

CVE-2026-27493-n8n has Unauthenticated Expression Evaluation via Form Node

n8n-io/n8n · GHSA-75g8-rv7v-32f7

medium2026-02-25

CVE-2026-25736-Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

rucio/rucio · GHSA-fq4f-4738-rqxm

medium2026-02-25

CVE-2026-25735-Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

rucio/rucio · GHSA-8wpv-6x3f-3rm5

medium2026-02-25

CVE-2026-25734- Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

rucio/rucio · GHSA-h9fp-p2p9-873q

high2026-02-25

CVE-2026-3105-Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting

mautic/mautic · GHSA-r5j5-q42h-fc93

medium2026-02-25

CVE-2026-27799-ImageMagick has a heap Buffer Over-read in its DJVU image format handler

imagemagick/imagemagick · GHSA-r99p-5442-q2x2

medium2026-02-25

CVE-2026-27798-ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

imagemagick/imagemagick · GHSA-qpgx-jfcq-r59f

high2026-02-25

hexchat crate has a Use After Free vulnerability

pie-flavor/hexchat-rs · GHSA-x43w-ph7m-pfjx

low2026-02-25

CVE-2026-1229-CIRCL has an incorrect calculation in secp384r1 CombinedMult

cloudflare/circl · GHSA-q9hv-hpm4-hj6x

low2026-02-25

ImageMagick: Heap-based Buffer Overflow in GetPixelIndex due to metadata-cache desynchronization

imagemagick/imagemagick · GHSA-gq5v-qf8q-fp77

medium2026-02-25

CVE-2026-56368-ImageMagick: Memory Leak in multiple coders that write raw pixel data

imagemagick/imagemagick · GHSA-wfx3-6g53-9fgc

low2026-02-25

CVE-2026-56371-ImageMagick: Memory leak in coders/txt.c without freetype

imagemagick/imagemagick · GHSA-3q5f-gmjc-38r8

low2026-02-25

CVE-2026-56379-ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

imagemagick/imagemagick · GHSA-xpg8-7m6m-jf56

medium2026-02-25

CVE-2026-56378-ImageMagick: Malicious PCD files trigger 1‑byte heap Out-of-bounds Read and DoS

imagemagick/imagemagick · GHSA-wgxp-q8xq-wpp9

low2026-02-25

mageMagick has a possible use-after-free write in its PDB decoder

imagemagick/imagemagick · GHSA-3j4x-rwrx-xxj9