9276 matches found
CVE-2026-27498
n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration...
[SECURITY] Fedora 43 Update: udisks2-2.11.1-1.fc43
The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies...
JetBrains TeamCity < 2025.11.3 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow CVE-2026-28194 - In JetBrains TeamCity before...
CVE-2026-27509
Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 EDU do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publi...
CVE-2026-27509
Unitree Go2 firmware versions V1.1.7 through V1.1.9, and V1.1.11 EDU do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programmingactuator/request handled by actuatormanager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publi...
The vulnerability of the destroy() function in the drivers/md/dm-cache-target.c file of the Linux operating system’s device driver framework for multiple devices (such as RAID and LVM) allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the destroy function in the drivers/md/dm-cache-target.c file of the Linux kernel driver for multiple device drivers such as RAID and LVM is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...
The vulnerability of the raid_message() function in the drivers/md/dm-raid.c module of the Linux kernel support for multiple device types (RAID and LVM) allows a hacker to cause a service failure.
The vulnerability of the raidmessage function in the drivers/md/dm-raid.c module of the Linux support for multiple device types RAID and LVM is related to the occurrence of mutual locking. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-27498
n8n is an open source workflow automation platform. Prior to versions 2.2.0 and 1.123.8, an authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration...
n8n has Arbitrary Command Execution via File Write and Git Operations
Impact An authenticated user with permission to create or modify workflows could chain the Read/Write Files from Disk node with git operations to achieve remote code execution. By writing to specific configuration files and then triggering a git operation, the attacker could execute arbitrary she...
CVE-2025-10010
The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to decrypt the Windows partition. The system is located on a separate unencrypted partition which can be reached by anyone with access to the hard disk. Multiple...
GHSA-XFVG-8V67-J7WP TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
I. Summary A Stored Cross-Site Scripting XSS vulnerability exists in the file upload module of TypiCMS. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation, the content of the SVG file is not sanitized. An attacker can upload a...
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
I. Summary A Stored Cross-Site Scripting XSS vulnerability exists in the file upload module of TypiCMS. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation, the content of the SVG file is not sanitized. An attacker can upload a...
EUVD-2026-8654
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...
CVE-2026-28196
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...
CVE-2026-28196
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...
CVE-2026-28196
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...
CVE-2026-28196
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk...
CVE-2026-28196
JetBrains TeamCity (before 2025.11.3) is affected by CVE-2026-28196, where disabling versioned settings can leave a credentials config on disk. The root cause is the residual credentials file after the operation, with a CVSS v3.1 base score of 2.3 (LOW) and local attack vector requiring user acce...
CVE-2026-26104
A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitiv...
