n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - Broken Access Control vulnerability discovered by MYUNGYONG LEE in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Booktics versions = 1.0.24...

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.21...

EUVD-2026-75723

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-9225

IBM Langflow OSS 1.0.0 through 1.11.5 is affected by an authorization bypass (CWE-639) in the File/Read File component. When executing flows via the /api/v1/run/advanced/{flow_id} endpoint, component inputs can reference storage paths using arbitrary user or flow identifiers without verifying own...

CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Arif Shaikh in WordPress Plugin Deposits and Partial Payments for WooCommerce versions = 3.1.0...

vRealizeLogInsightRCE

VMSA-2023-0001 VMware vRealize Log Insight に影響する VMSA-2023-0001 の POC です。以下の CVE を含みます: VMware vRealize Log Insight ディレクトリトラバーサルの脆弱性 CVE-2022-31706 VMware vRealize Log Insight アクセス制御の不備の脆弱性 CVE-2022-31704 VMware vRealize Log Insight 情報漏えいの脆弱性 CVE-2022-31711 この脆弱性のデフォルト設定では、リバースシェルを作成する cron...

EUVD-2026-75726

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2023-49543

CVE-2023-49543 Book Store Management System v1.0 - 不正なアクセス制御 説明 : Book Store Management System v1 における不適切なアクセス制御により、攻撃者は認証なしで権限のないページにアクセスし、管理機能を実行できます。 脆弱な製品バージョン : Book Store Management System v1.0 CVE作成者 : Geraldo Alcântara 日付 : 29/11/2023 確認日 : 15/12/2023 CVE : CVE-2023-49543 テスト環境 : Windows ...

BlockGuard

🛡️ BlockGuard — プロセスベースのファイルアクセスセキュリティエージェント BlockGuard は、Windows のデータ損失防止（DLP）エージェントであり、プロセスレベルでファイルアクセスを傍受・制御します。実行可能ファイルパス、暗号ハッシュ、Authenticode 署名、整合性レベルによって識別される承認済みプロセス のみが保護されたファイルを読み取れるようにし、それ以外のすべてのプロセスは NTFS ACL を介して OS カーネルレベルでデフォルト拒否 されます。 📑 目次 特徴 アーキテクチャ UI 管理インターフェース 前提条件 クイックスタート 設定...

CVE-2026-1375

CVE-2026-1375：Tutor LMS 插件中的已认证 IDOR / 失效的访问控制 免责声明： 本仓库仅用于教育目的和道德披露 。该漏洞已负责任地向供应商报告并已修补。请勿利用此信息在未经适当授权的情况下攻击系统。 摘要 在 WordPress 的 Tutor LMS 插件（版本 = 3.9.5）中发现了不安全的直接对象引用（IDOR）/ 失效的访问控制 漏洞。该缺陷允许拥有 Tutor 讲师 角色的低权限用户执行未经授权的批量操作，例如更改其他讲师或管理员所拥有课程的状态，或将其永久删除。 通过拦截合法的后端请求并篡改课程 ID...

CVE-2026-88959

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-88939

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...

CVE-2026-4129

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

EUVD-2026-75572

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

CVE-2026-88959 Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...

EUVD-2026-75564

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...