2252 matches found
CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and...
CVE-2026-86080
n8n , an open source workflow automation platform, is affected by a fail-open signature verification flaw in its GitHub Trigger . When GitHub returns HTTP 422 and the node reuses an existing webhook, the generated webhook secret is discarded , leaving workflow static data with a webhookId but no ...
EUVD-2026-69419
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion...
CVE-2026-81379
Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
Visual Studio Code Security Feature Bypass Vulnerability
Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...
Siemens SIPLUS and SIMATIC Products
SUMMARY Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where...
CVE-2026-82758
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
EUVD-2026-72540
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
EEF-CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Summary Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through...
CVE-2026-82758
ash_authentication_oauth2_server (ash-project, Elixir) has an Improper Authentication flaw in resolve_secret/3: any secret-provider return other than {:ok, _} or :error was treated as valid, wrapping nil, false, or "" as {:ok, value}. When the initial_access_token resolves to such an empty value,...
CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
CVE-2026-82758 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
Improper Authentication vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolvesecret/3 in AshAuthentication.Oauth2Server reached through resolvesecre...
CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...
CVE-2026-86486
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
CVE-2026-86486
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
EUVD-2026-72502
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
CVE-2026-86486
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...
PT-2026-86928
Improper Authentication vulnerability in ash-project ash authentication oauth2 server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an initial access token. resolve secret/3 in AshAuthentication.Oauth2Server reached through resolve...