352329 matches found
EUVD-2026-56141
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...
CVE-2026-72762
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...
CVE-2026-72762 n8n before 1.123.67 Arbitrary File Write via Edit Image Node
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...
CVE-2026-72762 n8n before 1.123.67 Arbitrary File Write via Edit Image Node
n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...
CVE-2026-72762
n8n has an arbitrary file write vulnerability in the Edit Image node affecting versions before 1.123.67, 2.31.5, and 2.32.1. An authenticated user who can run workflows can pass a crafted format value, which is forwarded to the underlying image library without validation, enabling writing arbitra...
Exploit for CVE-2026-17106
CVE-2026-17106 – Vulnerability in “docker cp” allowing arbitra...
CVE-2026-72609
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...
CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...
CVE-2026-72609 Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...
EUVD-2026-56130
An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...
CVE-2026-72609
Koha vulnerability CVE-2026-72609: An SQL injection in Koha up to versions 24.11.17, 25.05.12, 25.11.06, and 26.05.01 affects the acqui/parcels.pl flow. Authenticated staff with acquisition => order_receive permission can read arbitrary database contents via the orderby parameter passed to C4:...
CVE-2026-72602 AsyncFuncAI deepwiki-open - Path Traversal
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...
CVE-2026-72602
CVE-2026-72602 affects AsyncFuncAI deepwiki-open. A path traversal flaw in the local-repository structure endpoint (through commit 16f35a0) allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths, since WIKI_AUTH_MODE defaults to false. This enables enu...
EUVD-2026-56041
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...
CVE-2026-72602 AsyncFuncAI deepwiki-open - Path Traversal
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...
CVE-2026-72602
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...
CVE-2026-72599 e107 e107 - SQL Injection
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...
CVE-2026-72599
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...
CVE-2026-72599
Summary: CVE-2026-72599 affects e107 2.4.0 and is an SQL injection in the news item page ID parameter. The parameter is concatenated into a SQL WHERE clause without escaping, enabling unauthenticated remote attackers to read, modify, or delete all database contents (including administrator creden...
EUVD-2026-56038
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...