CVE-2026-65908: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...

CVE-2026-64805: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64804: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling...

CVE-2026-64808: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling...

corradin-opioid-project (0.1.0), pricetool (0.1.0) potentially affected by CVE-2026-73415 via jupyterlab (0.31.1)

jupyterlab PYPI version 0.31.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - corradin-opioid-project 0.1.0 - pricetool 0.1.0 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

corradin-opioid-project (0.1.0), pricetool (0.1.0) potentially affected by CVE-2026-73626 via jupyterlab (0.31.1)

jupyterlab PYPI version 0.31.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - corradin-opioid-project 0.1.0 - pricetool 0.1.0 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

elyra (>=0.6.0, <=0.10.3), gcp-jupyterlab-shared (>=1.0.1, <=1.0.8) +5 more potentially affected by CVE-2026-73626 via jupyterlab (1.2.21)

jupyterlab PYPI version 1.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra =0.6.0, =1.0.1, =0.1.0, =1.0.1, =0.2.1, =0.1.0a16, =0.1.0a22 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

Impact An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project...

GHSA-2XGM-WC4G-5JVG n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

Impact An authenticated user with permission to create workflows in one project could bypass project/folder authorization boundaries during workflow creation. By supplying a crafted request payload, the user could associate a newly created workflow with a folder belonging to a different project...

EUVD-2026-42268

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects...

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Impact External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be available. An authenticated user with project editor access could read the plaintext value of external secrets by referencing them in a node expression, without needing explicit secre...

GHSA-2434-3X6Q-8R99 n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Impact External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be available. An authenticated user with project editor access could read the plaintext value of external secrets by referencing them in a node expression, without needing explicit secre...

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

Impact An authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This can be leveraged to bypass authentication, allowing unauthenticated requests to be treated as a privileged user...

DRUPAL-CONTRIB-2026-089

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-086

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-085

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-084

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials,...

NPM: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

NPM: n8n: AI Agents Project Viewer Privilege Escalation via runnodetool vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

GHSA-X5VX-C2C8-M3W9 n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials,...