WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure vulnerability

Unauthenticated Payment Gateway Credentials Disclosure vulnerability discovered by Animesh Gaurav WPScan in WordPress Plugin Payments for Hubtel versions 1.0.2...

CVE-2026-103757

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103259

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103256

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

EUVD-2026-90686

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

EUVD-2026-90653

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an...

CVE-2026-103259

The n8n application versions before 2.39.6 and 2.40.x before 2.40.1 are vulnerable to a session token leakage in the Dynamic Credentials authorize and revoke endpoints. Attackers who possess resolver registration capability can capture collaborators' session tokens by configuring a fallback resol...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

EUVD-2026-90650

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103256

The n8n automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to a credentials leak via a preAuthentication Hook. The flaw resides in the Wekan and Baserow username-and-password credential types, where the application fails to properly validate host fields. Attackers wi...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

Security Bulletin: Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities in IBM Cloud Pak System

Summary Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities were found in Cloud Pak SystemCVE-2026-3295, CVE-2023-38375, CVE-2026-3161,CVE-2026-4418. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...