EUVD-2026-90750

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-103246

The n8n workflow automation tool is vulnerable to Credential Disclosure in versions prior to 2.39.6 and 2.40.x before 2.40.1 . The root cause is a failure to validate credential ownership during inline agent node-tool introspection . An attacker can reference arbitrary credential IDs to decrypt a...

CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

BIT-PARSE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply...

Security Bulletin: Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities in IBM Cloud Pak System

Summary Cross-site Scripting, HTML Injection and Use of Weak Cryptographic Algorithm vulnerabilities were found in Cloud Pak SystemCVE-2026-3295, CVE-2023-38375, CVE-2026-3161,CVE-2026-4418. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by jtb75 in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.31...

BIT-RABBITMQ-2026-67410 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

BIT-RABBITMQ-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

BIT-RABBITMQ-2026-66076 RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

BIT-RABBITMQ-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...

BIT-RABBITMQ-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

BIT-RABBITMQ-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

BIT-OPENBAO-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

BIT-DISCOURSE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...

BIT-DISCOURSE-2026-84302 Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did n...

CVE-2026-64948 Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...

CVE-2026-64948 Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...

CVE-2026-64948

Pandora FMS version 777 and onwards is vulnerable to an authorization bypass in the module data retrieval process. Specifically, missing authorization in the get_module_detail AJAX endpoint allows for unauthorized cross-group access to module history. This flaw enables a user to view history data...

BIT-KIBANA-2026-72662 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user granted the Timeline feature privilege in a Kibana space could...