EUVD-2026-90654

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advan...

CVE-2026-103260 n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advan...

CVE-2026-83560

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CVE-2026-83560 New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

EUVD-2026-89634

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

WordPress New User Approve plugin 3.1.0-3.2.9 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin New User Approve versions 3.1.0-3.2.9...

CVE-2026-83560

The New User Approve WordPress plugin, versions 3.1.0 through 3.2.9 , contains a vulnerability where it fails to properly verify authentication on specific integration REST API routes when the integration is left unconfigured. This flaw allows unauthenticated attackers to perform a Zapier API Key...

CVE-2026-83560 New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

PT-2026-99138

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 2.0.0 Description An issue exists where the endpoint '/attendance/approve-validate-attendance-request/' modifies attendance validated, is validate request approved, approved by, and pending-request states via an HTTP...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

EUVD-2026-82619

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-82982

The Approval app's approve/reject endpoint contained a bypass in its etag freshness check , which is designed to prevent an approver from approving or rejecting a file whose contents changed after review. The backend only enforced the check when the etag parameter was present and non-empty; an at...

CVE-2026-82982: Undefined Security Weakness

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-76900: Server-Side Request Forgery (SSRF)

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...

CVE-2026-82537

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82536

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...

CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...

CVE-2026-82537

Roo-Code through version 3.54.0 contains an auto-approve bypass vulnerability caused by a word-boundary mismatch in comment handling between the approval gate's shell parser and bash . An attacker can craft a command string pairing an allowlisted word with a hash character, separator, and a denie...

EUVD-2026-74041

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...