191679 matches found
PT-2026-89242
Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description The miniorange saml module fails to correctly restrict access to specific administrative functionality. This flaw allows unauthorized users to perform forceful browsin...
SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorangesaml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...
PT-2026-89253
Name of the Vulnerable Software and Affected Versions Taxonomy Term Glossary versions 0.0.0 through 4.6.0 Description Insufficient access control on taxonomy terms allows anonymous users to view any taxonomy terms on the site, including those that are unpublished or restricted. This is possible...
CVE-2026-86994
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast ...
CVE-2026-86993
n8n is an open-source workflow automation platform. Prior to 1.123.76 , 2.37.7 , and 2.38.2 , a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check . A user with a custom global role carrying Log Streami...
CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming...
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
Summary Nodemailer's disableFileAccess / disableUrlAccess options are a security sandbox that lets an application forbid untrusted message content html/text/attachment path/href from reading local files or making outbound HTTPS requests. The fix for GHSA-wqvq-jvpq-h66f commit 5f69497 threaded the...
CVE-2026-86996 n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...
EUVD-2026-74267
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted...
GHSA-4MVJ-M6J5-PMF7 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-75998
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...
CVE-2026-75998
Adobe ColdFusion is affected by an Improper Access Control flaw (CWE-284) that allows an unauthenticated, remote attacker to perform an arbitrary file system read , gaining access to sensitive files and directories outside the intended scope. No user interaction is required. The CVSS 3.1 score is...
CVE-2026-75998 ColdFusion | Improper Access Control (CWE-284)
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...
CVE-2026-75998 ColdFusion | Improper Access Control (CWE-284)
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...
EUVD-2026-74070
ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction...
CVE-2026-77487
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-77480
Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-73028
Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network...