n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in...

WordPress Bulk Page Generator – LPagery plugin <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 2.5.7...

CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

CVE-2026-13055

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

CVE-2026-13075 $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

EUVD-2026-47769

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-65013

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-65013

Technical details about CVE-2026-65013 are not publicly available in the provided documents; monitor for updates.

CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

Exploit for Command Injection in Grafana

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Py...

CVE-2026-62145

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...

Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters...

CVE-2026-65593 n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

Path Traversal

Snipe-IT is vulnerable to Path Traversal. The vulnerability is due to unsanitized filename parameter concatenation, where an authenticated attacker can traverse outside the intended directory and read arbitrary files accessible to the web server process...

CVE-2026-15787

The CVE concerns The Ultimate Addons for Elementor (WordPress) up to version 2.9.1, where a Stored XSS exists in the Navigation Menu Widget via data-toggle-icon/data-close-icon attributes. The root cause is insufficient input sanitization and output escaping; wp_kses_post is applied on save for u...

CVE-2026-63048

CVE-2026-63048 affects the Joomla extension Page Builder CK (joomlack.fr) prior to version 3.6.2. The issue is improper access control allowing an authenticated user to upload arbitrary files, enabling remote code execution (RCE). This is described as an authenticated arbitrary file upload leadin...

CVE-2026-63048 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE...

CVE-2026-15802

The CVE covers the WP Foodbakery WordPress plugin. Affected: all versions up to 4.9. Vulnerability: arbitrary file deletion due to insufficient validation in delete_locations_backup_file_callback. Impact: authenticated attackers with subscriber-level access can delete arbitrary files on the serve...