CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

EUVD-2026-63266

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 have a VM sandbox escape in the task runner: the prototype-freezing routine misses internal constructors like EventEmitter, allowing an authenticated user with Code node access to pollute prototypes and execute arbitrary commands. The corruption is...

vigolium v0.4.3

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

roamr v0.1.4

roamr Find the best WiFi network for where you are, without dropping your connection. In an office or home with several WiFi networks, the best one changes as you move, and "best" isn't just signal bars. A network can show full bars and still be slow: crowded 2.4 GHz, an old WiFi standard, a...

Directory Traversal

Overview agno is an Agno: a lightweight library for building Multi-Agent Systems Affected versions of this package are vulnerable to Directory Traversal through the readfile, savetofile, and runpythonfile actions. An attacker can read, write, or execute arbitrary files by supplying a filename wit...

EUVD-2026-62935

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

PT-2026-80750

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

PT-2026-80779

Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...

Linux Distros Unpatched Vulnerability : CVE-2026-49283

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive...

PT-2026-80314

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

Grafana Labs 11.2.0 <= 11.6.16 / 12.2.0 <= 12.2.10 / 12.3.0 <= 12.3.8 / 12.4.0 <= 12.4.5 / 13.0.0 <= 13.0.3 / 13.1.0 < 13.1.1 Information Disclosure (CVE-2026-11817)

The version of Grafana Labs installed on the remote host is 11.2.x through 11.6.x prior or equal to 11.6.16, 12.2.x prior or equal to 12.2.10, 12.3.x prior or equal to 12.3.8, 12.4.x prior or equal to 12.4.5, 13.0.x prior or equal to 13.0.3, or 13.1.0. It is, therefore, affected by an information...

PT-2026-78933

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description A JavaScript task runner VM sandbox escape exists where the prototype-freezing routine fails to cover internal module constructors, such as...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the FlatFileItemReader when handling specially crafted input files that exploit the way multi-line records are assembled. An attacker can cause excessive CPU and memory consumptio...

CVE-2026-76370

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

CVE-2026-59992

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-76370 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

CVE-2026-76370 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

CVE-2026-76370

In Splunk SOAR versions below 8.6.0 with multi-tenancy enabled, the REST API fails to enforce role-based tenant restrictions, allowing authenticated low-privileged users to enumerate names and IDs of tenants outside their role scope. CVSS 3.1 scores 4.3 (Medium) for confidentiality impact. No exp...

CVE-2026-55482

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...