HackerOne: HackerOne Code sends live password-reset tokens to Segment in automatic page events

A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page...

CVE-2026-76360: Missing Authorization

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not...

CVE-2026-72650 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

Malicious code in ec-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8245936c8beb04bdb2bfe31a8117133823e3ffd6ed3e165d89b822dfab4a9c package.json declares a preinstall script that runs npm install @sentry/node && node examples/verify.js. examples/verify.js initializes the package's...

Malicious code in workflow-postgres-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19848a1b4a7188ada5866c459ec2b966b9aa6ba1d23e3c25b1f54939e6a6b963 The package advertises itself as a Postgres/workflow setup helper but ships no library code — the declared main entry index.js is absent from the...

CVE-2026-45582

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters before sending workflow data to the project's anonymous telemetry...