CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, verdaccio, gitlab-rails-ce-fips, redisinsight, langfuse-fips, commitizen, kibana, dotstatsuite-supercore, prism, wazuh-dashboard-fips, opensearch-dashboards, unleash, tensorflow-gpu-jupyter, unleash-fips, commercial-gitlab-rails-ee, arangodb,...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, verdaccio, gitlab-rails-ce-fips, redisinsight, langfuse-fips, commitizen, kibana, dotstatsuite-supercore, prism, wazuh-dashboard-fips, opensearch-dashboards, unleash, tensorflow-gpu-jupyter, unleash-fips, commercial-gitlab-rails-ee, arangodb,...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, verdaccio, gitlab-rails-ce-fips, redisinsight, langfuse-fips, commitizen, kibana, dotstatsuite-supercore, prism, wazuh-dashboard-fips, opensearch-dashboards, unleash, tensorflow-gpu-jupyter, unleash-fips, commercial-gitlab-rails-ee, arangodb,...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, verdaccio, gitlab-rails-ce-fips, redisinsight, langfuse-fips, commitizen, kibana, dotstatsuite-supercore, prism, wazuh-dashboard-fips, opensearch-dashboards, unleash, tensorflow-gpu-jupyter, unleash-fips, commercial-gitlab-rails-ee, arangodb,...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_47058)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202647058 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...

PT-2026-103788

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the Supabase node where the tableId parameter is inserted into request paths without proper validation. This allo...

PT-2026-105115

cleanup xml node in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion...

PT-2026-105135

cleanup xml node in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion...

PT-2026-105145

cleanup xml node in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion...

PT-2026-103786

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute D...

PT-2026-103779

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.39.6 n8n versions 2.40.0 through 2.40.0 Description Insufficient validation of credential ownership occurs during inline agent node-tool introspection. This allows attackers to reference arbitrary credential IDs to...

Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790253961)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790253961 advisory. - brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in th...

PT-2026-103787

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the signed resume URL generation for Send-and-Wait approvals. Users with workflow creation permissions can forge...

PT-2026-103778

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

PT-2026-105154

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is authorized/2 uses is authorized monitor for all methods. DELETE resets rabbit core metrics:reset auth attempt metrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbit mgmt w...

Rocky Linux 10.2 [CIQ] Security Update: nodejs24 / nodejs24-debuginfo / nodejs24-debugsource / etc Multiple Vulnerabilities (crlsa-2026_48034)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202648034 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed ta...

Rocky Linux 9 [CIQ] Security Update: perl-XML-LibXML / perl-XML-LibXML-debuginfo / etc (crlsa-2026_39553)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639553 advisory. perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names CVE-2026-8177 Tenable has extracted the preceding description block directly...

CVE-2026-103247: Authorization Bypass Through User-Controlled Key

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...

Linux Distros Unpatched Vulnerability : CVE-2026-92873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2024_5814)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20245814 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction via...