CVE-2026-54308 n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to...

CVE-2026-56696

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

EUVD-2026-38469

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

CVE-2026-54312 n8n: Microsoft SQL Node Prototype Pollution

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype...

CVE-2026-28496 FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection SSTI vulnerability in the template rendering system. Administrators with access to features that render Twig templates email templates, mass mail campaigns, custo...

ROOT-APP-MAVEN-CVE-2022-36944 CVE-2022-36944 in io.root.org.scala-lang:scala-library - Patched by Root

Root has patched CVE-2022-36944 in the io.root.org.scala-lang:scala-library package for Root:Maven. Multiple fixed versions available...

CVE-2026-56379

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbitrary MVG drawing commands. Attackers can craft malicious SVG files with injected Magick Vector Graphics commands that execute during rendering...

CVE-2026-56371 ImageMagick - Memory Leak in TXT File Processing via Texture Attribute

ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT files with texture attributes: the texture object allocated via ReadImage is not released when GetTypeMetrics fails, leaking memory each time a crafted TXT file with a texture attribute is process...

EUVD-2026-38430

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforcehashedapikeys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to th...

SUSE-SU-2026:2524-1 Security update for libinput

This update for libinput fixes the following issues - CVE-2026-50265,CVE-2026-50292: crafted uinput devices can lead to local privilege escalation bsc1267852...

GHSA-VJHF-6XFR-5P9G vulnerabilities

Vulnerabilities for packages: harvester, virt-operator-fips, virt-launcher, harvester-fips, virt-operator, virt-controller-fips...

GHSA-25MH-HP8X-CGRV vulnerabilities

Vulnerabilities for packages: harvester, virt-operator-fips, virt-handler, virt-launcher, harvester-fips, docker-machine-driver-harvester, virt-controller-fips...

GHSA-F4XH-W4CJ-QXQ8 vulnerabilities

Vulnerabilities for packages: puppygraph-python, open-webui, py3-langsmith...

CVE-2026-54905 vulnerabilities

Vulnerabilities for packages: logstash, ruby3.2-rails, ruby3.3-fluentd-kubernetes-daemonset, logstash-fips, ruby3.2-fluentd-kubernetes-daemonset, kube-fluentd-operator, ruby3.4-rails, ruby3.4-fluentd-kubernetes-daemonset, cinc-auditor, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-rails,...

GHSA-4XPC-PV4P-PM3W vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2026-8378

creationtimestamp| type| source ---|---|--- 2026-06-23 08:16:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxko6srr2l...

CVE-2026-8163

creationtimestamp| type| source ---|---|--- 2026-06-23 08:11:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxbpfcwv2j...

CVE-2026-55654

creationtimestamp| type| source ---|---|--- 2026-06-23 07:53:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowwbexkdi2a...

CVE-2026-7842

creationtimestamp| type| source ---|---|--- 2026-06-23 07:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moww3fmi5f2f...

CVE-2026-8378

The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability...