20103 matches found
CVE-2026-63684
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...
CVE-2026-63684
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...
EUVD-2026-47804
Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items...
WordPress GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Viet Anh Ngo in WordPress Plugin GutenKit versions = 2.4.12...
CVE-2026-9029
A flaw was found in the Grafana geomap panel's XYZ tile layer. An attacker with editor privileges can exploit a sanitize-then-interpolate ordering bug by setting a textbox variable's default value to a Cross-Site Scripting XSS payload. This payload executes for every user who opens the dashboard,...
Security update for joe
This update for joe fixes the following issue CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...
SUSE-SU-2026:3196-1 Security update for joe
This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379...
CVE-2026-13192 RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...
GHSA-VHCW-F978-XJJG Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p3rg-hrf9-w9gj. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in...
CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...
CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...
@polygonjs/plugin-mediapipe-facemesh (>=1.1.1, <=1.1.218), @polygonjs/polygonjs (>=1.1.124, <=1.1.239) +7 more potentially affected by CVE-2026-45820 via fflate (0.6.9)
fflate NPM version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on fflate and may be impacted: - @polygonjs/plugin-mediapipe-facemesh =1.1.1, =1.1.124, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.1, =0.5.0, =1.1.124-1, =1.1.239-1 Source cves:...
@polygonjs/plugin-mediapipe-facemesh (>=1.1.1, <=1.1.218), @polygonjs/polygonjs (>=1.1.124, <=1.1.239) +7 more potentially affected by CVE-2026-45820 via fflate (0.6.9)
fflate NPM version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on fflate and may be impacted: - @polygonjs/plugin-mediapipe-facemesh =1.1.1, =1.1.124, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.1, =0.5.0, =1.1.124-1, =1.1.239-1 Source cves:...
PT-2026-67358
Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inli...
PT-2026-70167
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.31.5 n8n versions prior to 2.32.1 Description A sandbox escape exists during expression evaluation. An authenticated user with permissions to create or modify workflows can use arrow-function bodies to bypass the...
PT-2026-63500
Name of the Vulnerable Software and Affected Versions Regular Labs extension affected versions not specified Description Administrator actions, editor popups, and import/export requests lack consistent token, item-permission, and input-validation checks. This allows unauthorized backend users or...
PT-2026-67366
JupyterLab 4.5+ allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructio...
dbeaver v26.1.3
DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...
