18 matches found
CVE-2026-110848: Improperly Controlled Modification of Object Prototype Attributes
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...
BIT-RABBITMQ-2026-66075 RabbitMQ: Monitoring-tag user can restart federation links
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, isauthorized/2 for the /federation-links/.../restart route uses isauthorizedmonitor accepts the monitoring tag, while allowedmethods permits DELETE and deleteresource/2 triggers...
PT-2026-105053
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is authorized/2 for the /federation-links/.../restart route uses is authorized monitor accepts the monitoring tag, while allowed methods permits DELETE and delete resource/2 triggers rabbit...
PT-2026-96139
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Insufficient validation of user input in the emoji field of the page emoji update endpoint allows an attacker to inject long text and line breaks. This action...
PT-2026-95796
Name of the Vulnerable Software and Affected Versions Flex Import versions prior to 3.1 Description The plugin contains a missing authorization flaw. The license activate fleximp and license deactivate fleximp functions, which are linked to the wp ajax license activate fleximp and wp ajax license...
CVE-2026-23596
A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability...
MAL-2025-166712 Malicious code in teaa-reborn15 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8be6db5fdde2ff213ec3795244b75ba0003b841c5b28b968e63e0b95b89dbaf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-134788 Malicious code in kiki-enting98-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68ceb83c8d91b79f2654b06a3a4bdd5f9b8abf431645fedba513cd34d9329167 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-54089 Cross-site Scripting vulnerability in Secure Access prior to 14.10
CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can interfere with another administrator’s access to the console. The attack complexity is low; there are no attack requirements. Privileges...
pgAgent security vulnerability
pgAgent is an open source job scheduler for PostgreSQL from the pgAdmin Project. A security vulnerability exists in pgAgent versions prior to 4.2.3 that stems from insufficient initialization of the random number generator used to generate directory names, which allows a local attacker to...
CVE-2024-10455 Reachable Assertion in µD3TN
Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block...
Microsoft’s Digital Crime Unit Goes Deep on How It Disrupts Cybercrime
Ten years in, Microsoft’s DCU has honed its strategy of using both unique legal tactics and the company’s technical reach to disrupt global cybercrime and state-backed actors...
PT-2023-32942 · Atlassian · Confluence
Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server versions 5.6 through 7.19.13 Confluence Data Center and Server versions 8.0 through 8.5.0 Description: This issue allows an unauthenticated attacker to cause a resource to be unavailable for its intended user...
CVE-2022-39061
ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated remote attacker can exploit this vulnerability to access partial sensitive content in memory and disrupts partial services...
CVE-2020-5874
On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management MicrokernelTMM...
F5 Networks BIG-IP : TMM vulnerability (K13053402)
An unauthenticated remote attacker may be able to disrupt services on F5 BIG-IP 11.4.1 - 11.5.4 devices with maliciously crafted network traffic. This vulnerability affects virtual servers associated with TCP profiles when the BIG-IP system's tm.tcpprogressive db variable value is set to...
PT-2012-1337
Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.6 Description The issue concerns the deleteinstallfiles function in control/ContentController.php, which does not require ADMIN permissions. This allows remote attackers to delete index.php, disrupting m...
