CVE-2026-2395 SQLi in Xpoda Türkiye Informatics Technology's No Code Platform

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4...

CVE-2026-13189 SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

CVE-2026-13189

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

CVE-2026-13189

CVE-2026-13189 affects Progress © Telerik® UI for AJAX (prior to v2026.2.708). The issue stems from insufficient validation of the language parameter in the spell check handler, which may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests. ...

EUVD-2026-47694

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

GHSA-FMVG-VHQQ-R2MJ Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-89gh-3pgc-v5h2. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data,...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

EUVD-2026-47655

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

SQLi

SQL Injection Detector A multithreaded SQL injection detectio...

EUVD-2026-47633

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

CVE-2026-65589

CVE-2026-65589 affects n8n versions before 1.123.64. The vulnerability arises because custom HTTP header credentials used by the LLM sub-node execution data are not masked, causing plaintext API keys and secrets to be written to workflow execution records. Authenticated users with access to execu...

CVE-2026-65589

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

CVE-2026-65589 n8n before 1.123.64 Credential Exposure via LLM Node Execution Data

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

CVE-2026-65589 n8n before 1.123.64 Credential Exposure via LLM Node Execution Data

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

Allocation of Resources Without Limits or Throttling

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the ES|QL query evaluation. An attacker can exhaust available query worke...

EUVD-2026-47591

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

EUVD-2026-47570

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: High...

EUVD-2026-47337

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...

EUVD-2026-46443

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...