GHSA-Q3J5-8VRG-4P9Q n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

Impact An authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression. When an HTTP Header Auth credential is applied to a paginated request, the secret is present...

CVE-2026-64793

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to...

CVE-2026-64792

Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the processing of CSS @font-face directives referencing local files via the file:// protocol. An attacker can determine the existence of sensitive files on the server by submitting crafted HTML and analyzing the...

CVE-2026-64793 Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to...

EUVD-2026-47817

Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access...

CVE-2026-64793

CVE-2026-64793 affects Joomla Extensions Articles Anywhere and Modules Anywhere by regularlabs.com. The issue is that content tags could use ignore flags or property overrides to render restricted or unpublished articles/modules, allowing a content author to expose content to visitors who lack re...

CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions

Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or...

CVE-2026-64794

Summary: CVE-2026-64794 affects Joomla extensions from regularlabs.com, specifically Users Anywhere and Articles Anywhere. The vulnerability stems from how user tags, filters, and conditions can access insufficiently restricted user fields, enabling exposure of authentication-related data, raw us...

EUVD-2026-47816

User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details...

CVE-2026-64792

Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could...

GO-2026-6035 Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content in gitea.dev...

GO-2026-6019 Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper...

GO-2026-6040 Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev

Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev...

CVE-2026-13061

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...

EUVD-2026-47769

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-3482

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request...

GHSA-9R8P-H6CC-6QHM n8n: Google Service Account Private Key Exposed in JWT Header

Impact When n8n was configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field which should only have held a key identifier. Since JWT headers were Base64-encoded rather than encrypted, the key could be recovered by anything that...

n8n: Google Service Account Private Key Exposed in JWT Header

Impact When n8n was configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field which should only have held a key identifier. Since JWT headers were Base64-encoded rather than encrypted, the key could be recovered by anything that...