CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

CVE-2026-65592

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

CVE-2026-65591

n8n before 1.123.64 is affected by a sanitizer bypass in the legacy expression evaluator’s computed-member handler. An authenticated user with workflow create/modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution in the n8n process. The ...

EUVD-2026-47633

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

CVE-2026-14322

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment...

CVE-2026-14322 Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment...

EUVD-2026-47588

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

EUVD-2026-47578

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

EUVD-2026-46636

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

EUVD-2026-46439

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

PT-2026-63354

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

PT-2026-63368

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...

Plone 2.5.x < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 / 4.1.x < 4.1.1 Multiple Vulnerabilities (HF 20110531)

The version of Plone installed on the remote host is 2.5.x prior to 2.5.5, 3.x prior to 3.3.6, 4.x prior to 4.0.4, 4.1.x prior to 4.1.1. It is, therefore, affected by the following vulnerabilities: - Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script or...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

CVE-2026-65316

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63142 Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

CVE-2026-63142

CVE-2026-63142 affects Kibana's Reporting feature. An incomplete list of disallowed inputs (CWE-184) can allow an authenticated user to bypass outbound request restrictions configured by an admin, causing the reporting service to issue requests to network destinations that should be denied. The C...

EUVD-2026-46409

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-65316 xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...