BIT-GITEA-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

BIT-GITEA-2026-104626 Gitea fork workflow job revival through later approval

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

Exploit for Cross-site Scripting in Concretecms Concrete_Cms

CVE-2026-18116 Stored XSS via Calendar Event Name to Admin...

CVE-2026-107718

A flaw was found in AdonisJS HTTP Server. The route URL generation helper fails to properly encode parameter values when constructing redirect destinations. A remote attacker can exploit this flaw by supplying a crafted path parameter starting with a forward slash, generating a scheme-relative...

PT-2026-114245

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

@n8n/agents (0.27.0), @n8n/ai-node-sdk (0.32.0) +36 more potentially affected by unknown CVE via n8n-workflow (2.42.0)

n8n-workflow NPM version 2.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-workflow and may be impacted: - @n8n/agents 0.27.0 - @n8n/ai-node-sdk 0.32.0 - @n8n/ai-utilities 0.35.0 - @n8n/ai-workflow-builder 1.42.0 - @n8n/api-types 1.42.0 -...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-73126): Gitea -- multiple vulnerabilities

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository...

PT-2026-114162

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

PT-2026-114167

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...

PT-2026-114158

n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referenci...

PT-2026-114156

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1 Description A prototype pollution issue exists in the MCP workflow-validation tool. The interpreter evaluates caller-supplied code in the main process, reads inherited properties...

PT-2026-114187

Name of the Vulnerable Software and Affected Versions Heym versions 0.0.55 through 0.0.120 Description A privilege escalation issue exists where shared collaborators can overwrite the error workflow id of a workflow. This occurs because the field is missing from OWNER ONLY EXECUTION FIELDS. An...

@0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1), @a700/n8n-nodes-agent700 (>=1.0.5, <=1.0.7) +2168 more potentially affected by unknown CVE via n8n-workflow (>=2.3.0, <=2.41.0)

n8n-workflow NPM version =2.3.0, =1.0.0, =1.0.5, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.2.2, =0.1.1, =0.3.6, =0.1.0, =0.1.1 - @avanquest/n8n-nodes-pdf-tools 1.0.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0149...

CVE-2026-71184: Incorrect Authorization

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork hea...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-71184): Gitea -- multiple vulnerabilities

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork hea...

PT-2026-114260

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The pull request review notifier fails to attach the pull request to the Actions notification. This causes the fork workflow approval gate to fail in recognizing that a run originates from a...

WS-2026-0168

n8n 2.2.0-2.43.4, 2.44.0 and @n8n/backend-services 1.3.0-1.3.2, 1.4.0: a client-chosen workflow ID such as proto makes the workflow-project cache return an inherited object with no project id, so the Data Table project check matches every project and members can read, change and delete Data Table...

CVE-2026-73800: Improper Control of Generation of Code

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-66877): Gitea -- multiple vulnerabilities

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and...

PT-2026-114276

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When a trusted base-branch workflow runs for a pull request target event, the system resolves local reusable workflow files from the head commit of a fork. This allows a fork author to modify a...