CVE-2026-66874: Improper Access Control

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from...

CVE-2026-66877: Improper Access Control

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and...

CVE-2026-110848: Improperly Controlled Modification of Object Prototype Attributes

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110853: Authorization Bypass Through User-Controlled Key

n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to...

CVE-2026-110842: Improperly Controlled Modification of Object Prototype Attributes

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member...

CVE-2026-110844: Incorrect Authorization

n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referenci...

WS-2026-0149

n8n-workflow 2.3.0-2.41.0 and 2.42.0: workflow-history compaction diffs connections with attacker-chosen keys such as proto as plain object members, polluting built-in prototypes and causing denial of service GHSA-fvv4-gmv9-xqf5...

PT-2026-114166

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.83 n8n versions prior to 2.41.4 n8n versions prior to 2.42.1 Description An authentication bypass exists due to dynamic-path webhook resolution matching requests based solely on the path, ignoring the server-generat...

CVE-2026-110852: Authentication Bypass Using an Alternate Path or Channel

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit...

CVE-2026-110118

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

EUVD-2026-98949

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-110118 WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-110118

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-110118 WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-110118

WorkFlow-Engine versions through 9.6.11 are susceptible to a missing authorization vulnerability (CWE-639) within the /vue/buttonOperation endpoints. This flaw allows low-privileged authenticated users to complete or reassign workflow tasks belonging to other users by supplying a known taskId to ...

CVE-2026-55675

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...

CVE-2026-69226

A security flaw in Portal for ArcGIS allows unauthenticated users to create new accounts via the sharing endpoint. The vulnerability occurs because the application fails to enforce restrictions even when self-service account registration is disabled (disableSignup=true ). An attacker can bypass t...

CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...

Windows DNS Denial of Service Vulnerability

Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network...

CVE-2026-89196

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...