138154 matches found
CVE-2026-19078
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
CVE-2026-72750
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL...
EUVD-2026-56141
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...
CVE-2026-72762 n8n before 1.123.67 Arbitrary File Write via Edit Image Node
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...
CVE-2026-72750
n8n versions before 1.123.67, 2.31.5, and 2.32.1 are affected by a SQL injection vulnerability in the Snowflake node's Execute Query operation. The root cause is that expression values are interpolated directly into the SQL string without parameterization, so when a workflow author embeds untrust...
CVE-2026-72607 Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...
CVE-2026-72538
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
Secrets Disclosure
Apache Airflow is vulnerable to Secrets Disclosure. The vulnerability is due to the AWS Systems Manager Parameter Store and Secrets Manager backends resolving a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed, where a caller in one team...
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
...
CVE-2026-19424
Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...
CVE-2026-19424 Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference
Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...
CVE-2022-50997: Improper Neutralization of Special Elements used in an SQL Command
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2026-19078: URL Redirection to Untrusted Site
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...
PT-2026-70912
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...
PT-2026-70788
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
PT-2026-70257
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...
VulnCheck KEV: CVE-2026-49049
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...
PT-2026-70927
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
CVE-2026-73084: Improper Neutralization of Input During Web Page Generation
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...
PT-2026-70784
Name of the Vulnerable Software and Affected Versions anoid versions prior to 3.3.12 anoid versions prior to 5.1.11 Description The nanoidsize function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer. Providing a value of 2147483648 causes it to...