16877 matches found
CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...
CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...
WordPress Elementor Website Builder – more than just a page builder plugin <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Or Benit in WordPress Plugin Elementor Website Builder versions = 4.2.3...
WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.27.13...
gstack
gstack "I don't think I've typed like a line of code probably since December, basically, which is an extremely large change." — Andrej Karpathy, No Priors podcast, March 2026 When I heard Karpathy say this, I wanted to find out how. How does one person ship like a team of twenty? Peter Steinberge...
RLSA-2026:80973 Important: flatpak-builder security update
Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git-am CVE-2026-86320 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...
flatpak-builder security update
An update is available for flatpak-builder. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securit...
CVE-2026-97471
The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...
CVE-2026-97471 Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token
The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...
EUVD-2026-100799
The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslinktarget' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...
CVE-2026-97471
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 3.16.1 . The flaw exists in the args[link_target] parameter, which allows unauthenticated attackers to extract arbitrary user meta values for any user ID. This includes ...
CVE-2026-5118
⚡ CVE-2026-5118 Divi Form Builder — Unauthenticated Privilege Escalation "Security Research" • "Defensive Detection" • "Vulnerability Research" --- 🔥 Overview CVE-2026-5118 is an unauthenticated privilege-escalation vulnerability affecting Divi Form Builder versions up to 5.1.2. The issue involve...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
EUVD-2026-100761
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
Rocky Linux 9 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80496)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680496 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descriptio...
AlmaLinux 10 : flatpak-builder (ALSA-2026:80495)
The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80495 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...
PT-2026-113629
The Avada Fusion Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'argslink target' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including...
Rocky Linux 10.2 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80495)
The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680495 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...