public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical1canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)0EPSS percentile observed

Monitored Vendors1from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-10-08 10:40 UTC / 2026-10-08 19:40 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-10-08

defensive priority signal

CRITICALEPSS 0.0056 (45)NEW-NVD: ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthent… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0053 (43)NEW-NVD: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attacke… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0024 (14)NEW-NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0026 (16)NEW-NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0043 (35)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0020 (9)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0019 (8)NEW-NVD: Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server S… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0030 (21)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0030 (20)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Su… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0027 (18)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0021 (10)NEW-NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-pas… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0028 (19)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0023 (13)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Or… Handoff

2026-10-08

defensive priority signal

HIGHEPSS 0.0020 (9)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the M… Handoff

2026-10-08

defensive priority signal

MEDIUMEPSS 0.0047 (38)NEW-NVD: Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to caus… Handoff

2026-10-08

defensive priority signal

MEDIUMEPSS 0.0030 (21)NEW-NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservi… Handoff

2026-10-08

defensive priority signal

MEDIUMEPSS 0.0021 (11)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulner… Handoff

2026-10-08

defensive priority signal

MEDIUMEPSS 0.0016 (4)NEW-NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in t… Handoff

2026-10-08

defensive priority signal

MEDIUMEPSS 0.0028 (19)NEW-NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Withi… Handoff

2026-10-08

defensive priority signal

MEDIUMEPSS 0.0024 (13)NEW-NVD: n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamp… Handoff

Public-safe defensive signals

CVE-2026-103244 CRITICAL CVSS 9.3 -
NVD: ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. NVD: Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover. OSV: ground-station before 0.8.0 Authentication Bypass via setup.restore
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authentication boundary review · remote exposure · authenticated boundary; CVSS 9.3 (CRITICAL); EPSS percentile 45; sources: NVD, OSV.
CVE-2026-103262 HIGH CVSS 8.7 -
NVD: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. NVD: Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions. OSV: Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
The affected service may become unavailable or unreliable; CVSS 8.7 (HIGH); EPSS percentile 43; sources: NVD, OSV.
CVE-2026-103259 HIGH CVSS 8.5 -
NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. NVD: Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access. OSV: n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.5 (HIGH); EPSS percentile 14; sources: NVD, OSV.
CVE-2026-103246 HIGH CVSS 8.3 -
NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. NVD: Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification. OSV: n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.3 (HIGH); EPSS percentile 16; sources: NVD, OSV.
CVE-2026-103257 HIGH CVSS 8.1 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. NVD: Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
An attacker may be able to reach files outside the intended application path; CVSS 8.1 (HIGH); EPSS percentile 35; sources: NVD, OSV.
CVE-2026-103251 HIGH CVSS 7.5 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. NVD: Attackers with Redis write access can bypass name validation, permission checks, checksum verification, and npm safety checks to install arbitrary npm packages across all cluster instances without authentication. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.5 (HIGH); EPSS percentile 9; sources: NVD, OSV.
CVE-2026-103082 HIGH CVSS 7.2 -
NVD: Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.2 (HIGH); EPSS percentile 8; sources: NVD.
CVE-2026-103248 HIGH CVSS 7.1 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. NVD: Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.1 (HIGH); EPSS percentile 21; sources: NVD, OSV.
CVE-2026-103255 HIGH CVSS 7.1 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. NVD: Attackers can exploit workflows binding tableId to untrusted input to traverse to Auth and Storage APIs using the administrative serviceRole key, bypassing Row Level Security and enabling unauthorized data access and modification. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
An attacker may be able to reach files outside the intended application path; CVSS 7.1 (HIGH); EPSS percentile 20; sources: NVD, OSV.
CVE-2026-103252 HIGH CVSS 7.1 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. NVD: Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
An attacker may be able to access information that should not be exposed; CVSS 7.1 (HIGH); EPSS percentile 18; sources: NVD, OSV.
CVE-2026-103256 HIGH CVSS 7.1 -
NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. NVD: Attackers with credential update permissions can modify the host field to receive account passwords at arbitrary hosts, bypassing domain validation controls. OSV: n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.1 (HIGH); EPSS percentile 10; sources: NVD, OSV.
CVE-2026-103254 HIGH CVSS 7.0 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. NVD: Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot access by exploiting unresolved traversal sequences in caller-controlled node IDs, enabling cross-project approval forgery. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
An attacker may be able to reach files outside the intended application path; CVSS 7.0 (HIGH); EPSS percentile 19; sources: NVD, OSV.
CVE-2026-103253 HIGH CVSS 7.0 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. NVD: Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
An attacker may be able to read or change database-backed application data; CVSS 7.0 (HIGH); EPSS percentile 13; sources: NVD, OSV.
CVE-2026-103250 HIGH CVSS 7.0 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. NVD: Unauthenticated attackers can supply MongoDB query operators in the sessionId field to access conversation histories from other users and perform unauthorized write and delete operations. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
A remote attacker may be able to read or change database-backed application data; CVSS 7.0 (HIGH); EPSS percentile 9; sources: NVD, OSV.
CVE-2026-103261 MEDIUM CVSS 6.9 -
NVD: Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. NVD: Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop. OSV: Tornado before 6.5.9 Denial of Service via Query String
The affected service may become unavailable or unreliable; CVSS 6.9 (MEDIUM); EPSS percentile 38; sources: NVD, OSV.
CVE-2026-103258 MEDIUM CVSS 6.9 -
NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. NVD: Attackers can exploit this by binding vulnerable node parameters to untrusted external input to widen single-record lookups into match-all queries, exposing bulk data including contact lists, tickets, and directory entries. OSV: n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.9 (MEDIUM); EPSS percentile 21; sources: NVD, OSV.
CVE-2026-103249 MEDIUM CVSS 6.9 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator OSV: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.9 (MEDIUM); EPSS percentile 11; sources: NVD, OSV.
CVE-2026-103245 MEDIUM CVSS 6.9 -
NVD: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. NVD: Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls. OSV: n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 6.9 (MEDIUM); EPSS percentile 4; sources: NVD, OSV.
CVE-2026-103260 MEDIUM CVSS 6.3 -
NVD: n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. NVD: Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions. OSV: n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 6.3 (MEDIUM); EPSS percentile 19; sources: NVD, OSV.
CVE-2026-103247 MEDIUM CVSS 5.8 -
NVD: n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. NVD: Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to attacker-controlled hosts. OSV: n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.8 (MEDIUM); EPSS percentile 13; sources: NVD, OSV.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-10-08 10:40 UTC / 2026-10-08 19:40 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2026-103082: newly added to the public-safe set.
CVE-2026-103244: newly added to the public-safe set.
CVE-2026-103245: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-10-08 01:05 UTC / 2026-10-08 10:05 JST

Items compared20 -> 20

Feed generated2026-10-08 10:40 UTC / 2026-10-08 19:40 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV19

Affected products0partial

CPE0partial

PURL0partial

Canonical vendor/product0partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-10-0820

Severity Distribution

CRITICAL 1
HIGH 13
MEDIUM 6
LOW 0
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

OSV19

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-103244

Critical / High1 / 13

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 1,
    "HIGH": 13,
    "LOW": 0,
    "MEDIUM": 6,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-103244"
}

Source Status

NVD20 signalsLast observed: 2026-10-08Status: healthy

EPSS20 signalsLast observed: 2026-10-08Status: healthy

OSV19 signalsLast observed: 2026-10-08Status: healthy

Vendor Advisory20 signalsLast observed: 2026-10-08Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled