34882 matches found
CVE-2026-103254
The software n8n is vulnerable to a path traversal vulnerability in its signed resume URL generation for Send-and-Wait approvals . Affected versions include those before 1.123.80 , 2.0.0 before 2.39.6 , and 2.40.0 before 2.40.1 . An attacker with workflow creation permissions can exploit unresolv...
EUVD-2026-90648
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
CVE-2026-103252
Versions of n8n prior to 1.123.80, 2.39.6, and 2.40.1 are vulnerable to an authorization bypass in the credential test endpoint . The root cause is the resolution of project-scoped variables without validating caller access. An attacker can provide an arbitrary project ID in the request body to i...
CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request...
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
EUVD-2026-90579
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
CVE-2026-103488
JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a missing authorization flaw. This vulnerability allows authenticated users to perform unauthorized actions by adding themselves to project teams, subsequently granting them access to restricted issues . Exploitation details are ...
CVE-2026-103488
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
ROOT-APP-GOBINARY-CVE-2026-39831 CVE-2026-39831 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2026-39831 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...
PT-2026-104032
Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description An issue exists in the save code to project function of the Coder module. This flaw enables directory traversal, a technique that allows an attacker to access or write files outside the intended project workspace...
PT-2026-103893
Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...
CVE-2026-103488: Incorrect Authorization
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...
PT-2026-103748
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Missing authorization allows authenticated users to add themselves to project teams, which enables them to access restricted issues. Recommendations Update to version 2026.2.19422...
CVE-2026-97281: Missing Authorization
Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...
PT-2026-105922
Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLC KEY or --key without also pinning the URL...
AlmaLinux 9.2 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1753730595)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753730595 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE componen...
pad-final-project (>=0.1.3, <=0.1.7), ppmanager (>=0.1.2, <=0.4.0) potentially affected by CVE-2026-102930 via virtualenv (20.28.0)
virtualenv PYPI version 20.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pad-final-project =0.1.3, =0.1.2, =0.4.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...
edgy-project (>=0.1.12, <=0.1.15), fallixy (0.18.1) +5 more potentially affected by CVE-2026-103262 via tornado (4.4.3)
tornado PYPI version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - edgy-project =0.1.12, =0.18.1, =0.1.2, =0.9.0, =1.2.1 - pymultitor 2.1.0 Source cves: CVE-2026-103262 Source advisory: OSV:GHSA-CHX6-46F5-W4VP...
