CVE-2026-84283 FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

EUVD-2026-84554

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-58424

CVE-2026-58424 - Gitea フォーク PR ワークフロー承認ゲートバイパス 重大度: 高 CVSS 8.9 影響を受けるバージョン: Gitea ≤ 1.26.2 修正バージョン: Gitea 1.26.3 アドバイザリ: GHSA-777r-4v59-6486 脆弱性の説明 Gitea Actions は、フォークされたプルリクエストによってトリガーされるワークフロー実行に対して承認ゲートを適用します。このゲートは ifNeedApproval に実装されており、信頼できないコントリビューターが CI...

CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

CVE-2026-92778 CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

CVE-2026-92778

CMAK (Yahoo's Cloud Management for Apache Kafka) through 3.0.0.6 contains a feature gate bypass in its HTML form routes. The scheduled leader election feature toggle is not applied to these routes, allowing an authenticated low-privilege attacker to access form endpoints and start or stop the rec...

CVE-2026-92778: Protection Mechanism Failure

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...

NPM: n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

NPM: n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...

GHSA-35JJ-42HP-8GMQ n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...

CVE-2026-86760

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

Linux Distros Unpatched Vulnerability : CVE-2026-82062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by...

PT-2026-89024

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077

n8n , an open-source workflow automation platform, contained an authorization flaw in the /chat WebSocket route (specifically the canResumeOverChat function in chat-execution-manager.ts). Prior to versions 2.37.7 and 2.38.2 , a resumeToken issued to an anonymous form submitter could be replayed o...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-82062

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container...