CVE-2026-22575

An improper access control vulnerability in Fortinet FortiManager and FortiManager Cloud allows a privileged administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests. Affected versions include FortiManager 7.6.0–7.6.4, 7.4.0–7.4.10, and 7.2 (all versio...

CVE-2026-22575

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator ...

Magnolia-CMS-6.2.19-Stored-Cross-Site-Scripting-CVE-2022-33098

Magnolia CMS = 6.2.19 Cross-Site Scripting Almacenado CVE-2022-33098 Tabla de Contenidos 1. Visión General 2. Descripción Detallada 3. Prueba de Concepto 4. Solución 5. Cronología de Divulgación 6. Referencias 7. Créditos 8. Avisos Legales Visión General Revisión: 1.0 Impacto: Cross-Site Scriptin...

gha-lab-8e9316151c

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

cve-2026-58138

CVE-2026-58138: RCE no autenticado en Conductor Kit de reproducción para CVE-2026-58138, una vulnerabilidad de inyección de código con CVSS 9.8 en Conductor. Contiene la regla de OpenTaint y las aproximaciones de GraalVM, pruebas de reglas aisladas, el resultado del escaneo y un exploit funcional...

CVE-2026-46420

CVE-2026-46420 PoC Inyección de comandos en shivammathur/setup-php cuando la versión de PHP se carga desde archivos controlados por el repositorio. Afecta: root@kitploit: = 2.25.0, = 2.37.1 PoC El repositorio objetivo ya tiene un flujo de trabajo vulnerable que descarga el contenido de la solicit...

gha-lab-6255f5fc33

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

CVE-2025-68613

CVE-2025-68613 n8n es una plataforma de automatización de flujos de trabajo de código abierto. Las versiones desde la 0.211.0 hasta anteriores a la 1.120.4, 1.121.1 y 1.122.0 contienen una vulnerabilidad crítica de ejecución remota de código RCE en su sistema de evaluación de expresiones de flujo...

Workflow session email approval process bypass

...

PT-2026-88503

Impact The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error...

PT-2026-88513

Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...

PT-2026-87188

Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...

PT-2026-87170

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator ...

PT-2026-88512

Impact The Git node's clone operation matched the destination path against the default N8N BLOCK FILE PATTERNS expression, which was written so that a crafted path caused catastrophic backtracking. Evaluation runs synchronously in the main n8n process, so an authenticated user could freeze the...

gha-lab-232af4821f

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of BraveUX/for-the-badge at commit...

gha-lab-00d54c717d

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of duck-organization/questbot at commit...

CVE-2024-25153

CVE-2024-25153 Este es una prueba de concepto para CVE-2024-25153, una vulnerabilidad de Ejecución Remota de Código en Fortra FileCatalyst Workflow 5.x, antes de 5.1.6 Build 114. Los detalles técnicos completos se pueden encontrar en...

gha-lab-8aba6b05dc

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of CloudPirates-io/helm-charts at commit...

gha-lab-5511dc3f73

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of CloudPirates-io/helm-charts at commit...

gha-lab-b9842b12c0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of projen/projen at commit...