CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-01-08 (5)

2026-01-08 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-01-08

5 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-21877 — 9.9 — n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able to execute malicious code using the n8n service. This could result in full compromise and can impac…
  • CVE-2025-69264 — 9.8 — pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disable…
  • CVE-2019-25296 — 9.8 — The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions in versions up to, and including…
  • CVE-2026-21876 — 9.3 — The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart …
  • CVE-2025-69222 — 9.1 — LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrictions of the Actions feature in the default configuration. Lib…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.