CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion reassignment path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorizati...

EUVD-2026-63262

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-77073 n8n before 2.34.1 Cross-Project Credential Access via MCP

n8n versions before 2.34.1 contain a credential validation bypass in the MCP createworkflowfromcode tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references...

CVE-2026-77073

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. An attacker with a valid MCP Bearer API key and a target credential ID can persist unauthorized cross-project credential references on work...

EUVD-2026-63137

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

PT-2026-78929

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 Description A credential validation bypass exists in the MCP create workflow from code tool when the authentication type is configured as an expression. An attacker possessing a valid MCP Bearer API key and a targe...

Linux Distros Unpatched Vulnerability : CVE-2026-76878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presen...

JetBrains YouTrack < 2026.1.13903 / 2026.2.x < 2026.2.17950 Information Disclosure (CVE-2026-75049)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13903, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could read restricted articles from other projects via the draft creation...

JetBrains YouTrack < 2026.2.17917 Missing Authorization (CVE-2026-75051)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.17917. It is, therefore, affected by a missing authorization vulnerability: - Unauthorised project transfer between organisations was possible. CVE-2026-75051 Note that Nessus has not tested for this issue but has...

PT-2026-78934

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 n8n versions prior to 2.33.4 Description An authorization bypass exists in the custom project role deletion and reassignment process. The system fails to perform project-level authorization checks when deleting a...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

DEBIAN-CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

UBUNTU-CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76878

CVE-2026-76878 affects OpenStack Aodh (before 22.0.1) and OpenStack Watcher (since Ussuri/Watcher 4.0.0). In Aodh, the alarm list API checks for the presence of the all_projects key rather than its value, so setting it to false removes the key and skips project-scoping logic. A non-admin user wit...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

DRUPAL-CONTRIB-2026-101

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons...

Linux Distros Unpatched Vulnerability : CVE-2026-34398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project...

PT-2026-78838

Name of the Vulnerable Software and Affected Versions OpenStack Aodh versions prior to 22.0.1 OpenStack Watcher versions 4.0.0 and later Description In OpenStack Aodh, the alarm list API fails to properly enforce project scoping when the all projects query parameter is set to false. The system...

CVE-2026-50186

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...