n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions

Impact The ExecuteWorkflow node's localFile source option read workflow files from disk without applying checks enforced by other file-reading nodes. An authenticated user with permission to create or modify workflows could supply an arbitrary file path via the REST API, bypassing the...

CVE-2026-43422

In the Linux kernel, the following vulnerability has been resolved: usb: legacy: ncm: Fix NPE in gncmbind Commit 56a512a9b410 "usb: gadget: fncm: align netdevice lifecycle with bind/unbind" deferred the allocation of the netdevice. This change leads to a NULL pointer dereference in the legacy NCM...

CVE-2026-43366

Summary: CVE-2026-43366 affects the Linux kernel’s io_uring/kbuf recycling path. A gap existed between when a buffer was grabbed and when it could be recycled; if the target list is empty, it could be upgraded to a ring-provided type without proper validation. The issue arises from missing checks...

GHSA-F693-58PC-2GFR OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

Summary Telegram legacy allowFrom migration fans default-account trust into all named accounts Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Shipped v2026.3.28 Telegram migration fans legacy default-account allowFrom trust into named accounts, which is an...

EUVD-2026-0925

Malicious code in react-transition-group-legacy npm...

CVE-2010-10015 AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow

AOL versions up to and including 9.5 includes an ActiveX control Phobos.dll that exposes a method called Import via the Phobos.Playlist COM object. This method is vulnerable to a stack-based buffer overflow when provided with an excessively long string argument. Exploitation allows remote attacke...

CVE-2024-36051

...

[SECURITY] Fedora 40 Update: libppd-2.1~b1-2.fc40

Libppd provides all PPD related function/API which is going to be removed from CUPS 3.X, but are still required for retro-fitting support of legacy printers. The library is meant only for retro-fitting printer applications, any new printer drivers have to be written as native printer application...

MAL-2024-4058 Malicious code in Be.Vlaanderen.Basisregisters.PаrcеlRegistry.Api.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4067 Malicious code in Be.Vlaanderen.Basisregistеrs.PаrсеlRegistry.Api.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4082 Malicious code in Be.Vlaanderen.Basisrеgisters.MuոicіpalityRegistrу.Api.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4134 Malicious code in Be.Vlaanderеn.Basisregisters.BuildingRegistry.Api.Legaсy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4136 Malicious code in Be.Vlaanderеn.Basisregisters.BսildіngRegistry.Api.Legaсy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4192 Malicious code in Be.Vlaanԁeren.Basisregisters.PostalRegistry.Apі.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4184 Malicious code in Be.Vlaanԁeren.Basisregisters.AddressRegistry.Apі.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4200 Malicious code in Be.Vlaanԁeren.Basisrеgisters.PostalRegistry.Apі.Legaсy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4295 Malicious code in Be.Vlаandereո.Basisregisters.StrеetNameRegistry.Api.Legaсy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-4382 CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF

The CB legacy WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks...

CB (legacy) <= 0.9.4.18 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to...

CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings via CSRF attacks PoC Codes:...