PT-2026-63350

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

PT-2026-63560

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Rules configured via rewrites or redirects that construct an external destination hostname using request-controlled input can be manipulated to point t...

CVE-2026-16270: Inefficient Regular Expression Complexity

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS attack. This issue was fixed in version 0.6.4...

Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)

The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting XSS and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the...

Plone 3.3.x < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20160830)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.12, or 5.0.x 5.0.7. It is, therefore, affected by the following vulnerabilities: - Directory traversal vulnerability in Plone CMS allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in ...

Oracle Linux 10 : edk2 (ELSA-2026-18320)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-18320 advisory. - Resolves: RHEL-165699 CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing rhel-10.2 Tenable has...

Plone 4.0.x < 4.3.20 / 5.0.x < 5.1.7 / 5.2.x < 5.2.2 Multiple Vulnerabilities (HF 20200121)

The version of Plone installed on the remote host is 4.0.x prior to 4.3.20, 5.0.x prior to 5.1.7, or 5.2.x prior to 5.2.2. It is, therefore, affected by the following vulnerabilities: - An open redirect on the login form and possibly other places allows an attacker to craft a link to a Plone Site...

Oracle Linux 10 : tomcat9 (ELSA-2026-18536)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18536 advisory. - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks...

Vulnerability of components /api/v1/validate/code and /api/v1/auto_login in the software for visual development of IBM Langflow OSS AI agents, allowing a perpetrator to execute arbitrary code.

The vulnerability of the software components /api/v1/validate/code and /api/v1/autologin of the IBM Langflow OSS visual development agent for AI agents is related to improper code generation management. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

PT-2026-63495

Name of the Vulnerable Software and Affected Versions OIDC::Lite versions through 0.12.1 Description An issue exists where ID Token signature verification can be bypassed due to a token-controlled algorithm allowlist in the verify function. When a caller does not specify a pinned algorithm, the...

The vulnerability of the hidraw_open() function in the drivers/hid/hidraw.c module of the Linux kernel’s device subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hidrawopen function in the drivers/hid/hidraw.c module of the Linux device subsystem driver module is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of t...

Plone products.isurlinportal < 1.2.0 Open Redirect

The version of Plone products.isurlinportal installed on the remote host is prior to 1.2.0. It is, therefore, affected by an open redirect vulnerability. An unauthenticated, remote attacker, can exploit this, via the 'is url in portal', to redirect to an external website after login. Note that...

CVE-2026-14881: Improper Neutralization of Special Elements used in an OS Command

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings...

Plone < 4.2.6 / 4.3.x < 4.3.2 Multiple Vulnerabilities (HF 20130618)

The version of Plone installed on the remote host is prior to 4.3.2. It is, therefore, affected by the following vulnerabilities: - traverser.py allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors relate...

Plone products.isurlinportal < 2.1.0 / 3.x < 3.1.0 Open Redirect

The version of products.isurlinportal installed on the remote host is prior to 2.1.0, or 3.x prior to 3.1.0. It is, therefore, affected by an open redirect vulnerability. An unauthenticated, remote attacker, can exploit this, via the url /login?camefrom=////evil.example, to redirect to an externa...

Plone 2.5.5 < 4.3.16 / 5.0.x < 5.0.10 Multiple Vulnerabilities (HF 20171128)

The version of Plone installed on the remote host is 2.5.5 prior to 4.3.16, 5.0.x prior to 5.0.10. It is, therefore, affected by the following vulnerabilities: - When you visit a page where you need to login, sends you to the login form with a 'camefrom' parameter set to the previous url...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access internal network resources, cloud metadata endpoints, or read arbitrary local...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access internal network resources, cloud metadata endpoints, or read arbitrary local...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access internal network resources, cloud metadata endpoints, or read arbitrary local...