n8n has an SSO Enforcement Bypass in its Self-Service Settings API

Impact An authenticated user signed in through Single Sign-On SSO could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy,...

CVE-2026-28194

In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow...

CVE-2026-27153

creationtimestamp| type| source ---|---|--- 2026-02-26 22:33:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsauxzcoq2n...

CVE-2026-28227

creationtimestamp| type| source ---|---|--- 2026-02-26 22:23:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsacdlvk32y...

CVE-2026-27457

creationtimestamp| type| source ---|---|--- 2026-02-26 22:10:19+00:00| seen| https://gist.github.com/alon710/3876c0d5d37ba696379319dc0ea4cb02 2026-02-26 23:17:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsddumm252e...

GHSA-WPPC-7CQ7-CGFV

creationtimestamp| type| source ---|---|--- 2026-02-26 22:10:19+00:00| seen| https://gist.github.com/alon710/3876c0d5d37ba696379319dc0ea4cb02...

CVE-2026-28227 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the publishtocategory topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known...

CVE-2026-28227 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the publishtocategory topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known...

EUVD-2026-8889

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing validatebeforecreate authorization in Data Explorer's QueryGroupBookmarkable allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata...

CVE-2025-63945

creationtimestamp| type| source ---|---|--- 2026-02-26 19:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfrw35w4ix23...

CVE-2026-26932

creationtimestamp| type| source ---|---|--- 2026-02-26 19:16:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfrvuuvvyf2u 2026-02-27 14:10:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mftva4kls32b...

GHSA-MJF5-7G4M-GX5W

creationtimestamp| type| source ---|---|--- 2026-02-26 19:10:19+00:00| seen| https://gist.github.com/alon710/09463d4ff783b0368066b3726e657169...

GHSA-MPF7-P9X7-96R3

creationtimestamp| type| source ---|---|--- 2026-02-26 18:10:19+00:00| seen| https://gist.github.com/alon710/e74bfaa6d377221316be43675ce67d75...

CVE-2026-27808

creationtimestamp| type| source ---|---|--- 2026-02-26 18:10:19+00:00| seen| https://gist.github.com/alon710/e74bfaa6d377221316be43675ce67d75 2026-07-10 23:00:59+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqdavfppxo2r...

CLSA-2026-1772125283 nodejs: Fix of 4 CVEs

CVE-2025-23167: fix improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. - CVE-2025-59466: fix uncatchable stack overflow exceptions when asynchooks are enabled, preventing denial-of-service crashes in applications using AsyncLocalStorage or...

GHSA-F3F2-MCXC-PWJX

creationtimestamp| type| source ---|---|--- 2026-02-26 16:40:19+00:00| seen| https://gist.github.com/alon710/1e84c2453d7b89234084625565fb6ff9 2026-05-04 20:02:07+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3ml2hnvchcj26...

CVE-2026-2679

creationtimestamp| type| source ---|---|--- 2026-02-26 16:37:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfrmyxkigp2k...

CVE-2026-2680

creationtimestamp| type| source ---|---|--- 2026-02-26 16:22:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfrm64by7w2o...

GHSA-MQPR-49JJ-32RC

creationtimestamp| type| source ---|---|--- 2026-02-26 16:10:19+00:00| seen| https://gist.github.com/alon710/178e566a3315ca4890a1f1cf1f52cff5...

CVE-2026-0323

creationtimestamp| type| source ---|---|--- 2026-02-26 15:42:41+00:00| seen| https://bsky.app/profile/index.espresso.cafecito.tech.ap.brid.gy/post/3mfrjwaxk52i2...