CVE-2026-65599 n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...

CVE-2026-65599

n8n is affected by a credential exposure in versions before 1.123.64, 2.29.8, and 2.30.1. When configured with a Google Service Account key, the full PEM private key was incorrectly placed in the JWT header’s kid field (intended as a key identifier). JWT headers are Base64-encoded, not encrypted,...

EUVD-2026-47621

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-2406

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

CVE-2026-2406

An authorization bypass in Universe Software's Online Registration and Workflow Management System (through 12022026) is reported as CVE-2026-2406. The vulnerability stems from a user-controlled key, enabling unauthorized access. CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; base score 6....

OPENSUSE-SU-2026:21410-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

EUVD-2026-47585

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the modules/activate dialog handler, which returns the full plaintext commercial license key to any authenticated user with the access.system permission. An attacker can obtain sensitive license information by...

PT-2026-63362

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

kernel security, bug fix, and enhancement update

5.14.0-687.29.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

PT-2026-63332

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

PT-2026-63398

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock...

UBUNTU-CVE-2026-59851

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled,...

PT-2026-63357

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field intended only for a key identifier. Because JWT headers are Base64-encoded...

RHEL 8 : pki-deps:10.6 (RHSA-2026:43218)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43218 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: jackson-databind:...

Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 For more details about the security issues, including the impact, a CVS...

UBUNTU-CVE-2026-59842

A flaw was found in libssh. During server-side GSSAPI key exchange, a...

kernel security, bug fix, and enhancement update

6.12.0-211.37.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

ALSA-2026:43218 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 For more details about the security issues, including the impact, a CVS...

CVE-2026-63259

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces the requester is not authorized to access...