CVE-2026-12752: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to achieve arbitrary code execution . The vulnerability exists within the FlwTaskController.java component and is triggered through several specific components and endpoints: FlwTaskServiceImpl.completeTask , CompleteExecuteComponent.proce...

PT-2026-92158

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow affected versions not specified Description An authenticated attacker can trigger restricted import actions because of missing authorization controls in both containerized and traditional deployments...

CVE-2026-12742: Missing Authorization

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...

CVE-2026-88616: Incorrect Authorization

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

PT-2026-92732

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Workflow. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks o...

PT-2026-92033

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

PT-2026-92056

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag version and node...

PT-2026-92162

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow containers and traditional affected versions not specified Description An XML external entity injection XXE occurs when processing XML data. This allows a remote attacker to expose sensitive information or...

CVE-2026-12756

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-18116

Concrete CMS versions 8.3.0 through 9.5.2 are affected by a Stored XSS in calendar event names. Event names were stored without sanitization and rendered without HTML escaping in the workflow approval/deletion notifications within the dashboard "Waiting For Me" block. A registered user with permi...

CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-18116

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-18116 Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

CVE-2026-12756

IBM Business Automation Workflow (containers and traditional) is vulnerable to an XML External Entity (XXE) injection when processing XML data. A remote attacker with low privileges could exploit this to expose sensitive information or consume memory resources . The vulnerability is rated CVSS 7....

CVE-2026-12756 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-12756 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-13107

IBM Business Automation Workflow (containers and traditional) versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, and 26.0.0-IF001 may use programming model artifacts in Advanced custom applications that are vulnerable to XML External Entity (XXE) injection by default (CWE-611). A remote authentic...

CVE-2026-13107 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...