150691 matches found
EUVD-2026-38461
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype...
CVE-2026-54312 n8n: Microsoft SQL Node Prototype Pollution
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype...
CVE-2026-54303
Summary of CVE-2026-54303 (n8n): An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or CSP headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. Affected component: n8n trigger no...
CVE-2026-54303 n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user...
EUVD-2026-38460
n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user...
CVE-2026-54303 n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user...
CVE-2026-11374
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover...
Exploit for Untrusted Pointer Dereference in Microsoft
Note The...
The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages lies in buffer overflows in dynamic memory, allowing attackers to execute arbitrary code.
The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise packages is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
PT-2026-51487
Name of the Vulnerable Software and Affected Versions ADSelfService Plus versions prior to 6529 RecoveryManager Plus versions prior to 6321 M365 Manager Plus versions prior to 4817 ADAudit Plus versions prior to 8703 Description In ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and...
The vulnerability of Microsoft Office and 365 Apps for Enterprise applications relates to buffer overflows in dynamic memory, which allows attackers to exploit the protected information.
The vulnerability of Microsoft Office and 365 Apps for Enterprise packages is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these security measures...
The vulnerability of Microsoft Exchange Server servers, related to insufficient validation of requests on the server side, allows attackers to perform spoofing attacks.
The vulnerability of Microsoft Exchange Server servers is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...
The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.
The vulnerability of Microsoft Office and 365 Apps for Enterprise packages relates to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
The vulnerability of Microsoft Exchange Server servers is related to insufficient protection of the website structure, which allows attackers to carry out spear-phishing attacks.
The vulnerability of Microsoft Exchange Server is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...
Microsoft 365 Copilot Command Injection Vulnerability (CNVD-2026-26512)
Microsoft 365 Copilot is an AI assistant integrated into the Microsoft 365 office suite. It offers features such as intelligent writing, data analysis, and content generation. Microsoft 365 Copilot has a command injection vulnerability. This vulnerability arises from the failure to properly...
The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations lies in the absence of an authentication process that would allow a malicious individual to escalate their privileges.
The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations is related to the absence of an authentication process. Exploiting this vulnerability can allow attackers to increase their privileges...
The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations is related to an incorrect definition of the link before accessing a file. This allows attackers to exploit their privileges.
The vulnerability of the Windows Microsoft PC Manager software for maintenance, cleaning, and security operations is related to an incorrect definition of the link before accessing a file. Exploiting this vulnerability can allow attackers to increase their privileges...
tmux image.c image_free use after free
...