{"vulnerability": "cve-2026-5468", "sightings": [{"uuid": "bb4251dd-6393-4894-bc76-45cf860b9bbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54682", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtmkg6nguo2r", "content": "\ud83d\udfe0 CVE-2026-54682 - High (8.2)\n\nDiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated wi...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54682/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-21T20:00:59.475092Z"}, {"uuid": "5274228d-f83c-4aa1-8ff8-2833e0a37219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54689", "type": "published-proof-of-concept", "source": "https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-wppf-h75h-6pm6", "content": "", "creation_timestamp": "2026-08-19T20:35:08.137030Z"}, {"uuid": "361b4fd7-c71a-4bdd-a3f7-f7d198bbddf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54688", "type": "published-proof-of-concept", "source": "https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-q87f-qc2r-2gw4", "content": "", "creation_timestamp": "2026-08-19T20:35:10.646380Z"}, {"uuid": "9f4b83fb-3fe8-4bbb-99d4-896da210986c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54685", "type": "published-proof-of-concept", "source": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w", "content": "", "creation_timestamp": "2026-07-08T18:35:05.868742Z"}, {"uuid": "d34ac61a-8781-4547-8b96-7e8e37fbf580", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54686", "type": "seen", "source": "https://t.me/GithubRedTeam/89060", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-54686-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-16 05:32:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:42.462075Z"}, {"uuid": "f9ec4cf1-965a-4ad0-a404-e410b9cb810a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54686", "type": "seen", "source": "https://t.me/GithubRedTeam/89060", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-54686-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-16 05:32:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:41.610873Z"}, {"uuid": "8761b76c-278e-4590-9ad8-1e682c62885f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54684", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfxhbupl25", "content": "CVE-2026-54684 - jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run\nCVE ID : CVE-2026-54684\n \n Published : July 14, 2026, 10:17 p.m. | 1\u00a0hour, 14\u00a0minutes ago\n \n Description : jadx is a Dex to Java decompiler...", "creation_timestamp": "2026-07-14T23:58:16.726703Z"}, {"uuid": "b47867a4-418b-48ab-8a73-f60a50655a45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54686", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89060", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-54686-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-16 05:32:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:07.312267Z"}, {"uuid": "08c22598-6c1b-4f0e-8071-d0ad4fe0b340", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54687", "type": "seen", "source": "https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8", "content": "# CVE-2026-54687: CVE-2026-54687: Path Traversal via User-Controlled Database File Path in n8n-nodes-sqlite3\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54687\n\n## Summary\nPrior to version 1.0.0, the n8n-nodes-sqlite3 integration exposed the db_path parameter as an unrestricted node parameter. By default, n8n node parameters allow the evaluation of dynamic data expressions, meaning untrusted external input could be mapped to the database path. This vulnerability allows an external attacker to control which SQLite database file the n8n backend process attempts to open, leading to directory traversal outside of the intended directory context.\n\n## TL;DR\nA path traversal vulnerability in n8n-nodes-sqlite3 prior to v1.0.0 allows remote attackers to read, create, or overwrite arbitrary database-compatible files via a manipulated db_path parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **Privileges Required**: None\n- **User Interaction**: Passive\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- n8n-nodes-sqlite3\n- **n8n-nodes-sqlite3**: < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade n8n-nodes-sqlite3 to version 1.0.0 or higher\n- Migrate to the credential-based V2 node architecture\n- Disable dynamic expression mapping on database paths\n\n**Remediation Steps:**\n1. Verify the current version of n8n-nodes-sqlite3 package.\n2. Execute npm update n8n-nodes-sqlite3 or update via the n8n community node interface.\n3. Rebuild workflows utilizing the SQLite node to adopt the V2 node definition.\n4. Ensure all db_path inputs are configured as static local paths and do not consume input from query, body, or header variables.\n\n## References\n\n- [Fix Commit](https://github.com/DangerBlack/n8n-node-sqlite3/commit/145a8876ff12375813bdcd4ae4fe78f460c53a98)\n- [Pull Request](https://github.com/DangerBlack/n8n-node-sqlite3/pull/25)\n- [GitHub Security Advisory](https://github.com/DangerBlack/n8n-node-sqlite3/security/advisories/GHSA-q7m3-rhxg-7vxr)\n- [Repository](https://github.com/DangerBlack/n8n-node-sqlite3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54687) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-28T00:01:49.256000Z"}, {"uuid": "41c855f1-bcf6-43ac-a03a-8b619a24a072", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54684", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmjv6zbsa27", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-54684 \u0432 jadx: \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 XAPK-\u0430\u0440\u0445\u0438\u0432\u044b\n\n\n\nhttps://kripta.biz/posts/BA980DEB-FF63-4C9D-823F-4B0C2F9A5A41", "creation_timestamp": "2026-07-27T09:01:05.311839Z"}, {"uuid": "952c2d3a-9972-4dbc-94a3-393aa2d2a085", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54684", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrmjvai4nu25", "content": "\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea \u05e7\u05d5\u05d3 \u05e4\u05ea\u05d5\u05d7: CVE-2026-54684 \u05d1-jadx - \u05e1\u05d9\u05db\u05d5\u05df \u05dc\u05d1\u05d9\u05e6\u05d5\u05e2 \u05e7\u05d5\u05d3 \u05d6\u05d3\u05d5\u05e0\u05d9\n\n\n\nhttps://khesef.xyz/posts/07BC4E11-FD3C-45D4-92B5-15D7A087F722", "creation_timestamp": "2026-07-27T09:01:06.592069Z"}, {"uuid": "4310b358-4cf1-4347-acb1-3afa160ff00c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54687", "type": "seen", "source": "https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8", "content": "# CVE-2026-54687: CVE-2026-54687: Path Traversal via User-Controlled Database File Path in n8n-nodes-sqlite3\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54687\n\n## Summary\nPrior to version 1.0.0, the n8n-nodes-sqlite3 integration exposed the db_path parameter as an unrestricted node parameter. By default, n8n node parameters allow the evaluation of dynamic data expressions, meaning untrusted external input could be mapped to the database path. This vulnerability allows an external attacker to control which SQLite database file the n8n backend process attempts to open, leading to directory traversal outside of the intended directory context.\n\n## TL;DR\nA path traversal vulnerability in n8n-nodes-sqlite3 prior to v1.0.0 allows remote attackers to read, create, or overwrite arbitrary database-compatible files via a manipulated db_path parameter.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **Privileges Required**: None\n- **User Interaction**: Passive\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- n8n-nodes-sqlite3\n- **n8n-nodes-sqlite3**: < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade n8n-nodes-sqlite3 to version 1.0.0 or higher\n- Migrate to the credential-based V2 node architecture\n- Disable dynamic expression mapping on database paths\n\n**Remediation Steps:**\n1. Verify the current version of n8n-nodes-sqlite3 package.\n2. Execute npm update n8n-nodes-sqlite3 or update via the n8n community node interface.\n3. Rebuild workflows utilizing the SQLite node to adopt the V2 node definition.\n4. Ensure all db_path inputs are configured as static local paths and do not consume input from query, body, or header variables.\n\n## References\n\n- [Fix Commit](https://github.com/DangerBlack/n8n-node-sqlite3/commit/145a8876ff12375813bdcd4ae4fe78f460c53a98)\n- [Pull Request](https://github.com/DangerBlack/n8n-node-sqlite3/pull/25)\n- [GitHub Security Advisory](https://github.com/DangerBlack/n8n-node-sqlite3/security/advisories/GHSA-q7m3-rhxg-7vxr)\n- [Repository](https://github.com/DangerBlack/n8n-node-sqlite3)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54687) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T22:31:50.832313Z"}, {"uuid": "07d2baa2-5d3d-41a2-9b7c-9eee3fd6396a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54680", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsi5rwobd22", "content": "CVE-2026-54680 - logging-operator\nA user with access to create certain resources can inject malicious Fluentd configuration, potentially allowing arbitrary command execution within the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#loggingoperator #kubelogging #Golang #CVE #infosec", "creation_timestamp": "2026-07-29T17:46:04.357008Z"}, {"uuid": "1c6aeac1-b172-4a91-894f-6c67083c070a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54680", "type": "published-proof-of-concept", "source": "https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h", "content": "", "creation_timestamp": "2026-07-29T18:35:06.215651Z"}, {"uuid": "123c3323-4af1-4b49-875e-68284c65b1d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54680", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrslm65dqc2s", "content": "CVE-2026-54680 - Logging operator has Fluentd configuration injection that allows remote code execution\nCVE ID : CVE-2026-54680\n \n Published : July 29, 2026, 5:16 p.m. | 27\u00a0minutes ago\n \n Description : Logging operator automates the deployment and configuration of Kubernetes l...", "creation_timestamp": "2026-07-29T18:47:48.179865Z"}, {"uuid": "834eb95b-e461-44fc-8d7f-d8f6c4e715e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54680", "type": "seen", "source": "https://gist.github.com/alon710/6b983b3c12e54633ff798b9f48527899", "content": "# CVE-2026-54680: CVE-2026-54680: Remote Code Execution via Fluentd Configuration Injection in Logging Operator\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54680\n\n## Summary\nA critical security flaw (CVE-2026-54680) in the Kubernetes Logging Operator allows authenticated attackers with namespace-level access to craft malicious Custom Resources that inject arbitrary configuration directives into the downstream Fluentd logging aggregator, resulting in unauthenticated remote code execution (RCE) in the context of the aggregator pod.\n\n## TL;DR\nAuthenticated users with Flow or ClusterFlow creation rights can inject newlines into Logging Operator Custom Resources, enabling downstream Fluentd configuration manipulation and arbitrary command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74, CWE-77\n- **Attack Vector**: Network\n- **CVSS Score**: 9.9 (Critical)\n- **Exploit Status**: PoC Available\n- **Scope**: Changed\n- **Privileges Required**: Low\n- **Impact**: Remote Code Execution (RCE)\n\n## Affected Systems\n\n- kube-logging/logging-operator\n- **Logging Operator**: < 6.6.0 (Fixed in: `6.6.0`)\n\n## Mitigation\n\n- Upgrade Logging Operator to 6.6.0 or higher.\n- Implement Kubernetes Admission Controller validation policies.\n- Deploy Fluentd with restricted Pod Security Standards.\n\n**Remediation Steps:**\n1. Identify all namespaces with Logging Operator deployments.\n2. Check current versions of the logging-operator controller.\n3. Update helm charts or deployment manifests to pull version 6.6.0.\n4. Deploy Kyverno or OPA policies to block invalid newline characters in Flow and Output resources.\n\n## References\n\n- [GitHub Security Advisory GHSA-mjqf-28ph-426h](https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h)\n- [Vulnerability Fix Commit](https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54680) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T23:31:32.281313Z"}, {"uuid": "0333d3b4-61ce-46f8-b418-171e8cad266e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54680", "type": "seen", "source": "https://gist.github.com/alon710/6b983b3c12e54633ff798b9f48527899", "content": "# CVE-2026-54680: CVE-2026-54680: Remote Code Execution via Fluentd Configuration Injection in Logging Operator\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54680\n\n## Summary\nA critical security flaw (CVE-2026-54680) in the Kubernetes Logging Operator allows authenticated attackers with namespace-level access to craft malicious Custom Resources that inject arbitrary configuration directives into the downstream Fluentd logging aggregator, resulting in unauthenticated remote code execution (RCE) in the context of the aggregator pod.\n\n## TL;DR\nAuthenticated users with Flow or ClusterFlow creation rights can inject newlines into Logging Operator Custom Resources, enabling downstream Fluentd configuration manipulation and arbitrary command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74, CWE-77\n- **Attack Vector**: Network\n- **CVSS Score**: 9.9 (Critical)\n- **Exploit Status**: PoC Available\n- **Scope**: Changed\n- **Privileges Required**: Low\n- **Impact**: Remote Code Execution (RCE)\n\n## Affected Systems\n\n- kube-logging/logging-operator\n- **Logging Operator**: < 6.6.0 (Fixed in: `6.6.0`)\n\n## Mitigation\n\n- Upgrade Logging Operator to 6.6.0 or higher.\n- Implement Kubernetes Admission Controller validation policies.\n- Deploy Fluentd with restricted Pod Security Standards.\n\n**Remediation Steps:**\n1. Identify all namespaces with Logging Operator deployments.\n2. Check current versions of the logging-operator controller.\n3. Update helm charts or deployment manifests to pull version 6.6.0.\n4. Deploy Kyverno or OPA policies to block invalid newline characters in Flow and Output resources.\n\n## References\n\n- [GitHub Security Advisory GHSA-mjqf-28ph-426h](https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h)\n- [Vulnerability Fix Commit](https://github.com/kube-logging/logging-operator/commit/cf437d7f1e056c78740bf5716ac8bdebcf002425)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54680) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T00:01:11.099944Z"}]}