CVE

CVE-2026-54305

View on NVD ↗

n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

Exploitation IoCs 7

Filename .ssh/authorized_keys

Filename /dev/shm/.a

Filename /etc/cron.d/.s

Filename /etc/cron.d/.sys_monitor

Filename /tmp/.a

Filename /var/tmp/.a

GitHub Repo Cursor agent

MITRE ATT&CK TTPs 1

Source Articles

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More

This week's threat landscape highlights critical vulnerabilities in widely used platforms such as WordPress, SonicWall, and Microsoft SharePoint, with active exploitation observed in the wild. A pre-authenticated remote code execution flaw in WordPress Core (CVE-2026-63030 and CVE-2026-60137) enables unauthenticated attackers to execute code, posing a significant risk due to WordPress's global reach. SonicWall SMA appliances were exploited via zero-day vulnerabilities prior to patching, while CISA added a SharePoint RCE (CVE-2026-58644) to its known exploited list. Additionally, new malware frameworks like OkoBot and NadMesh target crypto assets and cloud AI services, indicating evolving attacker tactics leveraging automation and AI.

hacker-news Jul 20, 2026