CVE-2026-65016

CVE-2026-65016 affects n8n versions before 1.123.64, 2.29.8, and 2.30.1. The issue lies in Enterprise SSO instance-role provisioning: the IdP-asserted role claim is mapped to an n8n global role without preventing assignment of the global:owner role. Consequently, an SSO-authenticated user whose i...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

EUVD-2026-47632

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

EUVD-2026-47509

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

EUVD-2026-47508

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

EUVD-2026-47177

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

EUVD-2026-47178

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.4-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Bas...

EUVD-2026-47074

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

PT-2026-63346

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-62473

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

CVE-2026-60907

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.4-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Bas...

CVE-2026-60908

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

CVE-2026-60904

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-50759

CVE-2026-50759 affects exo-explore exo 1.0.69. A remote attacker can escalate privileges via unauthenticated access to GET /state and DELETE /instance/{instance_id}. The vulnerability appears to allow privilege escalation without authentication, with CVSS 3.1 base score 7.5 (HIGH) and network exp...

PT-2026-62085

Name of the Vulnerable Software and Affected Versions exo-explore exo version 1.0.69 Description An issue allows a remote attacker to escalate privileges without authentication. This is possible through the 'GET /state' and 'DELETE /instance/instance id' endpoints, where instance id is a variable...

CVE-2026-50759

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/instanceid endpoints with no authentication...

CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63107

LimeSurvey (versions up to 6.17.10 and 7.0.4) contains a server-side request forgery in the REST API survey template endpoint. The vulnerability arises from unsanitized use of the HTTP Host header in getTemplateData(), allowing authenticated users to cause the server to issue arbitrary HTTP reque...