CVE-2026-103249: Improper Neutralization of Input During Web Page Generation

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor...

CVE-2026-102115 Kiteworks Core Authentication Bypass in the Password Reset Workflow

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then...

CVE-2026-102115

Kiteworks Core is vulnerable to an authentication bypass in its password reset workflow due to insufficient validation of a submitted parameter. An unauthenticated attacker who possesses a user's email address can reset the account's password without needing access to the emailed reset link. This...

CVE-2026-100276

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100276

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-100275

JetBrains YouTrack versions prior to 2026.2.19197 are vulnerable to stored XSS within the workflow error notification toast. This flaw allows for unauthorized script execution in the context of the user's session. Remediation is available in version 2026.2.19197 and subsequent releases. No specif...

CVE-2026-100276

In JetBrains YouTrack versions prior to 2026.2.19197 , an incorrect authorization vulnerability (CWE-863) allowed guest users to bypass visibility restrictions on workflow actions. This flaw enables unauthorized users to execute actions that should be restricted, potentially impacting system inte...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

EUVD-2026-90019

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

EUVD-2026-90020

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...

n8n-RCE-CVE-2025-68613

n8n CVE-2025-68613 Overview This repository contains an educational security research project focused on CVE-2025-68613 , a vulnerability affecting specific versions of n8n related to unsafe workflow expression evaluation. The project was tested only in a controlled local lab environment. About...

Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

CVE-2026-100275: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

PT-2026-103323

🚨 CVE-2026-100276 In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action 🎖@cveNotify...

PT-2026-103322

🚨 CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible 🎖@cveNotify...

Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems

As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has examined this risk primarily in adversarial settings, where agents are instructed or rewarded to communicate covertly and evade oversight. We show th...

CVE-2026-102616

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...