CVE-2026-16270 ReDoS in Open Mercato

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...

CVE-2026-16270

Open Mercato is affected by a ReDoS vulnerability where an attacker with privileges to create a regex rule can insert an unsafe regex into a field. The flawed validation allows crafted input to cause Denial of Service when processed by the system. The issue is fixed in version 0.6.4. If you are r...

CVE-2026-16270 ReDoS in Open Mercato

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...

Cross-site Scripting (XSS)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Resource Locator component when the cachedResultUrl parameter is passed to window.open without proper scheme validation. An attacker can execute arbitrary scripts in...

openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used...

CVE-2026-8152

CVE-2026-8152 affects Unblu Spark. The issue is an open redirect that can be escalated to a DOM-based XSS when deployed with com.unblu.identifier.siteEmbeddedSetup=true, causing injected JavaScript to run in the host app’s origin and gain access to cookies, DOM, and same-origin APIs. This expands...

EUVD-2026-47656

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-65592

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

CVE-2026-16551

CVE-2026-16551 affects Thinkst OpenCanary, MongoDB module, specifically OpenCanary version 0.9.8. The issue is a Denial-of-Service caused by excessive allocation, as described in the CVE records. The metric shows a CVSS v4.0 base score of 8.2 (HIGH) with network attack vector, low attack complexi...

CVE-2026-16551 Denial-of-Service in OpenCanary's MongoDB module

Denial-of-Service in Thinkst Applied Research OpenCanary MongoDB module allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only...

CVE-2026-65592

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

EUVD-2026-47636

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL

Summary Vulnerabilities in OpenSSL could cause denial of service CVE-2026-9076, CVE-2026-42767, CVE-2026-42766, heap buffer overflow CVE-2026-7383, crash and heap corruption CVE-2026-45447, forge authentication CVE-2026-45446, loss of confidentiality CVE-2026-45445, credential exposure...

EUVD-2026-46640

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-64001

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture PCM Pulse Code Modulation OSS Open Sound System component. A local user could exploit a Use-After-Free UAF vulnerability in the sndpcmossprocwrite function. This occurs when a setup entry is prematurely linked into the...

Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)

The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting XSS and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the...

Plone 4.0.x < 4.3.20 / 5.0.x < 5.1.7 / 5.2.x < 5.2.2 Multiple Vulnerabilities (HF 20200121)

The version of Plone installed on the remote host is 4.0.x prior to 4.3.20, 5.0.x prior to 5.1.7, or 5.2.x prior to 5.2.2. It is, therefore, affected by the following vulnerabilities: - An open redirect on the login form and possibly other places allows an attacker to craft a link to a Plone Site...

Important: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK: Enhance XBM...

PT-2026-63350

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...