PT-2026-70169

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...

CVE-2026-73157: Improper Neutralization of Input During Web Page Generation

Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolation. Because fields such as event IDs, event information, organization names, tags, tag colors, TLP labels, distribution labels, and error/flash text may be...

CVE-2026-68248

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...

CVE-2026-68248 drm/i915: Return NULL on error in active_instance

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...

EUVD-2026-55349

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...

CVE-2026-68248

CVE-2026-68248 affects the Linux kernel DRM/i915 driver. The vulnerability arises in the active_instance error path where a NULL node could be used, due to OOM during GFP_ATOMIC allocation, leading to unsafe return of a pointer. The fix modifies the path to return NULL on error instead of derefer...

Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing

SummaryIn every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...

Exploit for CVE-2026-19264

!CVE-2026-19264 - Unauthenticated Path Traversal to Full Instan...

The vulnerability of the config_dirs directive in the NGINX Agent daemon and the NGINX Instance Manager automation platform allows a malicious actor to gain unauthorized access to read and write arbitrary files.

The vulnerability of the configdirs directive in the NGINX Agent and the NGINX Instance Manager automation platform is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to read and write arbitrary...

PT-2026-69209

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description A server-side request forgery SSRF issue exists in the SSRF guard within httpSecurity.ts because the DEFAULT DENY LIST fails to include the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 a...

EUVD-2026-54311

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62836

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62836 Azure SQL Managed Instance Elevation of Privilege Vulnerability

...

CVE-2026-62836 Azure SQL Managed Instance Elevation of Privilege Vulnerability

...

CVE-2026-62836

CVE-2026-62836 affects Azure SQL Managed Instance. The vulnerability arises from improper restriction of the communication channel to intended endpoints, enabling a network-based elevation of privileges by an unauthenticated attacker. Affected products include Azure SQL Managed Instance (and rela...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

Azure SQL Managed Instance Elevation of Privilege Vulnerability

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

PT-2026-68832

Name of the Vulnerable Software and Affected Versions Azure SQL Managed Instance affected versions not specified Description Improper restriction of the communication channel to intended endpoints allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment,...

CVE-2026-62836: Improper Restriction of Communication Channel to Intended Endpoints

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-17556 Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id header

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...