CVE-2026-77076 n8n before 1.123.69 Credential Leak via GraphQL Node Error

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...

CVE-2026-77076 n8n before 1.123.69 Credential Leak via GraphQL Node Error

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...

EUVD-2026-63265

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error...

CVE-2026-70461

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications

A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document,...

CVE-2026-14952

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

CVE-2026-73542

creationtimestamp| type| source ---|---|--- 2026-08-20 08:45:04+00:00| seen| https://jvn.jp/en/vu/JVNVU91609598...

EUVD-2026-63223

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

CVE-2026-14948

FDS102 for FAdC/FAdCi R2 logs plaintext session identifiers into downloadable error log archives, allowing a low-privileged remote attacker to hijack admin sessions without credentials. No patch or exploitation evidence is provided; see VDE-2026-078 advisory.

CVE-2026-14948 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archives

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...

CVE-2026-76220

creationtimestamp| type| source ---|---|--- 2026-08-20 08:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtiro7oyye24...

webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information

A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...

CVE-2026-75860

creationtimestamp| type| source ---|---|--- 2026-08-20 07:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117126661700027750 2026-08-20 07:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mtipz7f4er27 2026-08-20 10:00:05+00:00| seen|...

vulnerabilities in Apple macOS

Apple has identified vulnerabilities in macOS Tahoe 26.6.2. These vulnerabilities relate to various aspects of memory management, input validation, and state management within Apple’s operating systems and Safari browser. Some of these vulnerabilities allow malicious actors to cause memory...

CVE-2026-14163

Octopus Server's deployment variable snapshot can expose sensitive variables in clear-text under certain circumstances, leading to confidentiality impact (CVSS 7.1 HIGH, network-accessible, low privileges required). Affected component is the deployment variable snapshot; no specific version range...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

kernel: smb: client: validate DFS referral PathConsumed

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System DFS referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds...

kernel: mm/huge_memory: update file PMD counter before folio_put()

A flaw was found in the Linux kernel's memory management, specifically within the huge page mechanism. When a huge page is split, the system updates a counter after releasing a reference to the memory. This timing issue can lead to the system attempting to read from memory that has already been...

kernel: smb/client: handle overlapping allocated ranges in fallocate

A flaw was found in the Linux kernel's Server Message Block SMB client. The smb3simplefallocaterange function, which manages file allocation, can incorrectly process overlapping allocated ranges provided by a server. This can result in parts of a file not being properly zero-filled, leading to...

kernel: drm/amdgpu: zero-initialize GART table on allocation

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. When allocating a Graphics Address Remapping Table GART, the memory was not properly initialized. This could allow a local attacker to potentially access uninitialized memory, leading to information disclosure or unexpected system...