CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

EUVD-2026-63270

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-76 / ESA-2026-77 / ESA-2026-118 / ESA-2026-119 / ESA-2026-133)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-76, ESA-2026-77, ESA-2026-118, ESA-2026-119, and ESA-2026-133 advisories. - Uncontrolled Recursion CWE-6...

Elasticsearch 8.19.x < 8.19.20 / 9.0.x < 9.4.5 DoS (ESA-2026-81)

The version of Elasticsearch installed on the remote host is 8.19.x prior to 8.19.20, or 9.0.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-81 advisory. - Elasticsearch does not apply its configurable input length restriction to a user-supplied patte...

PT-2026-78937

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description A regular expression denial of service ReDoS exists in the Filter and Switch nodes. The issue occurs because user-supplied regex...

CVE-2026-76401

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event...

CVE-2026-76401

Splunk Connect for Kafka versions below 2.2.7 are affected by a Regular Expression Denial of Service (ReDoS) vulnerability in the timestamp extraction feature. An unauthenticated user with network access to the Kafka Connect REST API can configure timestamp extraction with a crafted regular expre...

CVE-2026-76166

A flaw was found in modcluster's AdvertiseListenerImpl org.jboss.modcluster core module. A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest that is...

CVE-2026-72127

A flaw was found in the Linux kernel's netdev-genl component. A local user in a child process ID PID namespace can issue a NETDEVCMDNAPIGET command. This allows the user to observe the global PID of a NAPI kernel thread, even though the thread should not be visible within their PID namespace. Thi...

PT-2026-78324

Name of the Vulnerable Software and Affected Versions mod cluster affected versions not specified Description A flaw exists in the AdvertiseListenerImpl of the org.jboss.modcluster core module. An unauthenticated attacker can cause a denial of service by sending a single crafted UDP multicast...

PT-2026-80766

Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

CVE-2026-72215

A flaw was found in the Linux kernel. In 64-bit configurations, when the promprintf firmware entry point is called from a kernel thread other than the initial one, the stack pointer can be incorrectly manipulated by 32-bit firmware code. This incorrect handling of the stack can lead to the kernel...

CVE-2026-75843

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

CVE-2026-75851 ArcadeDB before 26.8.1 Authentication Bypass via Async Command

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

EUVD-2026-60542

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...

PT-2026-77335

The Zephyr kernel validates the k thread join and k thread abort system calls declared syscall in include/zephyr/kernel.h through thread obj validate in kernel/thread.c. Its default switch branch is the access-denied path, taken when k object validate returns -EPERM the calling user thread was...

Linux Distros Unpatched Vulnerability : CVE-2026-72103

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm: avoid leaking the caller's thread keyring via the table device file The refactoring in commit a28d893eb327 md: port block device access to file accidentally...

CVE-2026-9693

Mattermost versions 10.11.x = 10.11.20, 11.7.x = 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via t...