CVE-2026-59259 n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the...

CVE-2026-57996 phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USERADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and...

CVE-2026-44021

creationtimestamp| type| source ---|---|--- 2026-07-15 10:30:04+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mqojbaj2up2b...

CVE-2026-47992

creationtimestamp| type| source ---|---|--- 2026-07-15 10:18:35+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqoimquynu2z...

CVE-2026-42936

creationtimestamp| type| source ---|---|--- 2026-07-15 08:33:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqocr3ocif2c 2026-07-15 08:45:03+00:00| seen| https://jvn.jp/en/jp/JVN59875262...

CVE-2026-59839

creationtimestamp| type| source ---|---|--- 2026-07-15 07:22:41+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116922788149851186 2026-07-15 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n...

CVE-2026-12281

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

CVE-2026-12281 Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

EUVD-2026-44594

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

GHSA-XGMM-8J9V-C9WX

creationtimestamp| type| source ---|---|--- 2026-07-15 04:31:56+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvav64vs2k...

CVE-2026-8920

creationtimestamp| type| source ---|---|--- 2026-07-15 04:19:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnukuc5ul22 2026-07-15 16:45:06+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1...

CVE-2026-8919

creationtimestamp| type| source ---|---|--- 2026-07-15 04:14:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnubvidgw2i 2026-07-15 16:45:13+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1...

CVE-2026-15029

creationtimestamp| type| source ---|---|--- 2026-07-15 04:09:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntywrdti2u 2026-07-15 16:45:15+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1...

CVE-2026-11851

creationtimestamp| type| source ---|---|--- 2026-07-15 03:59:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntgzdrcl2h...

CVE-2026-13585

creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...

CVE-2026-57233

creationtimestamp| type| source ---|---|--- 2026-07-15 02:28:34+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqnoeb25ov2m 2026-07-17 16:15:03+00:00| seen|...

CVE-2026-15765

creationtimestamp| type| source ---|---|--- 2026-07-15 01:46:28+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqnlyxa5oo25 2026-07-16 04:45:09+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260716 2026-07-16 23:03:15+00:00|...

CVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...

PT-2026-60534

Name of the Vulnerable Software and Affected Versions NTFS-3G versions prior to 2026.2.25 Description A heap-based buffer overflow occurs in the build inherited id function within libntfs-3g/security.c. An attacker can corrupt heap memory in the SUID-root ntfs-3g binary by creating a file within ...

CVE-2026-15769

creationtimestamp| type| source ---|---|--- 2026-07-14 23:43:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnf5nd2jx2e 2026-07-16 04:45:18+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260716 2026-07-17 21:37:06+00:00| seen|...