CVE-2026-103251

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103245

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

EUVD-2026-90645

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...

CVE-2026-103245

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

ROOT-APP-MAVEN-CVE-2026-44249 CVE-2026-44249 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-44249 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-50010 CVE-2026-50010 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-50010 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-45416 CVE-2026-45416 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-45416 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-75595 CVE-2026-75595 in io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-75595 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

BIT-RABBITMQ-2026-67230 RabbitMQ: Web-STOMP unbounded pre-auth accumulation

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frame...

BIT-DISCOURSE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

CVE-2026-96268

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.4.0 . The root cause is insufficient input sanitization and output escaping of the 'gdpr-data' parameter within the wpas_gdpr_user_opt_o...

CVE-2026-103544

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...

CVE-2026-103541

A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of the component Ajax Handler. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit is...

EUVD-2026-90521

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...

CVE-2026-103544 datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...

CVE-2026-103544 datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...

CVE-2026-103544 datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...