GHSA-35Q8-9MJ6-WJMF n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider IdP to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the global:owner role, unlike the token-exchange identity path,...

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

NPM: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

GHSA-777W-RPR6-C52H n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

NPM: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

NPM: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

EUVD-2026-42612

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...

kernel: kernel: ipv6 frag escape

A flaw was found in the Linux kernel's ipv6 networking subsystem. An incorrect parameter length calculation allows an attacker with permissions to create UDP sockets to trigger overwrites of kernel memory, potentially leading to privilege escalation, data corruption, or a system crash...

kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF

A flaw was found in the Linux kernel's eventpoll mechanism. A Use-After-Free UAF vulnerability, where the system attempts to access memory after it has been freed, can occur during the removal of a file. A local attacker could exploit this race condition to corrupt memory, potentially leading to...

CVE-2025-50329

An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe...

CVE-2025-50330

An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe...

CVE-2025-50327

An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism...

[SECURITY] [DSA 6394-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6394-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 22, 2026 https://www.debian.org/security/faq -...

GO-2026-6034 Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev

Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 140.13.0 ESR MFSA 2026-70, bsc1271649: CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component. CVE-2026-15719: Site isolation issue in the DOM: Navigation component. CVE-2026-16349:...

Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs

Cybersecurity researchers have disclosed details of a new local privilege escalation LPE vulnerability in snap-confine that an unprivileged user can trigger to obtain root access and gain complete control of a target environment. The high-severity flaw, tracked as CVE-2026-8933 CVSS score: 7.8,...

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials,...

GHSA-X5VX-C2C8-M3W9 n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

Impact In n8n's AI Agents feature, a user with the read-only Project Viewer role could escalate their privileges by chatting with an agent that has node tools enabled. The agent's node-execution tool was authorized only by the agent:execute scope and ran nodes using the project's credentials,...

NPM: n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

NPM: n8n: AI Agents Project Viewer Privilege Escalation via runnodetool vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

CVE-2026-16157

CVE-2026-16157 affects Duplicati v2.3.0.1 on Windows. The MSI installer registers a LocalSystem service that executes binaries from the installation directory. If installed to a non-default path (outside the default C:\Program Files\Duplicati 2), a standard local user can write to the service dir...