19035 matches found
PT-2026-44915
Impact The POST /rest/dynamic-node-parameters/options endpoint allowed any authenticated user to cause the n8n server to issue HTTP requests including credentials bypassing the intended restrictions on which hosts could be contacted for that credential Allowed HTTP Request Domains. The user neede...
PT-2026-51414
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.20.0 Description An issue in the "POST /rest/dynamic-node-parameters/options" endpoint allows authenticated users with credential access to bypass Allowed HTTP Request Domains restrictions. This enables an attacker to...
Drupal core 安全漏洞
Drupal Core is a free, open-source content management system developed in PHP by the Drupal community. There are security vulnerabilities in Drupal Core, which stem from improper control of dynamic object attribute determination, potentially leading to object injection attacks. The following...
CtrlPanel.gg 安全漏洞
CtrlPanel.gg is an open-source hosting service billing management tool developed by CtrlPanel.gg. Versions of CtrlPanel.gg prior to 1.1.1 contained security vulnerabilities. These vulnerabilities stemmed from the management settings update endpoint accepting user-provided class names and using th...
PT-2026-42013
Name of the Vulnerable Software and Affected Versions CtrlPanel versions prior to 1.2.0 Description An authenticated admin-level user can achieve Remote Code Execution by supplying an arbitrary class name available in the Composer autoloader. The admin settings update endpoint accepts a fully...
Taking Cryptography out of the Data Path Via Near-Memory Processing in DRAM
Cryptographic algorithms such as AES-128 and SHA-256 are fundamental to ensuring data security and integrity. Although these algorithms are computationally efficient, their performance is often constrained by the processor-centric architectures e.g., CPUs, GPUs, primarily due to the memory...
Improper Validation of Array Index
Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unvalidated URL processing in the OAuth2 dynamic client registration process. An attacker can access internal network resources or sensitive information by supplying malicious URLs to be fetched by t...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unvalidated URL processing in the OAuth2 dynamic client registration process. An attacker can access internal network resources or sensitive information by supplying malicious URLs to be fetched by t...
Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
Summary The mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol MCP security specifications. Specifically, it processes untrusted URLs for OAuth-related discovery and metadata without verifying if the targets are malicious or internal to...
GHSA-QJP4-4JVR-XQG3 Spring AI MCP Security: Unvalidated URL Fetching (SSRF)
Summary The mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol MCP security specifications. Specifically, it processes untrusted URLs for OAuth-related discovery and metadata without verifying if the targets are malicious or internal to...
MantisBT 1.0.0 < 2.28.2 Dynamic Custom Textarea Field Reflected XSS (GHSA-j7v9-f46r-2rp4)
The version of MantisBT installed on the remote host is 1.0.0 or later but prior to 2.28.2. It is, therefore, affected by a vulnerability: - MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field. CVE-2026-41897 Note that Nessus has not tested for this issue but has...
The vulnerability of the DCP-ETSI protocol analyzer, a traffic analyzer for computer networks developed by Wireshark, allows a hacker to cause a service failure.
The vulnerability of the DCP-ETSI protocol analyzer, a tool for analyzing computer network traffic with Wireshark, is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
The vulnerability of the XRDP server, related to buffer overflows in dynamic memory, allows a attacker to cause a service failure or execute arbitrary code.
The vulnerability of the XRDP server is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure or execute arbitrary code...
The vulnerability of the XRDP server, related to buffer overflows in dynamic memory, allows a attacker to cause a service failure.
The vulnerability of the XRDP server is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
PT-2026-41691
Name of the Vulnerable Software and Affected Versions mcp-security versions prior to 0.1.9 Description The mcp-security framework fails to implement mandatory Server-Side Request Forgery SSRF mitigations—a flaw where an attacker can induce the server to make requests to an unintended location—as...
The vulnerability of the iLBC audio codec used by Wireshark, a network traffic analyzer for computers, allows a hacker to cause a service failure.
The vulnerability of the iLBC audio codec used by Wireshark, a network traffic analyzer, is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow attackers to cause system failures...
The vulnerability of the XRDP server, related to buffer overflows in dynamic memory, allows a hacker to execute arbitrary code.
The vulnerability of the XRDP server is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the N8n automation platform, related to deficiencies in the authentication process, allows a malicious actor to reuse the external API key and gain unauthorized access to protected information.
The vulnerability of the N8n automation platform lies in the deficiencies of the authentication process when processing the dynamic-node-parameters endpoint. Exploiting this vulnerability allows an attacker to re-use the external API key and gain unauthorized access to protected information...
