CVE-2026-16560

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation. Mitigation Deni...

GHSA-5VFW-JC4P-FJ39 Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q5xf-xhwf-cwqf. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow w...

Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q5xf-xhwf-cwqf. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow w...

GHSA-38FJ-36M5-783C Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters...

Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Red Hat JBoss Web Server 6.2.4 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Red Hat JBoss Web Server 6.2.4 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65593

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

EUVD-2026-47655

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44192 Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...

CVE-2026-44192 Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...

RLSA-2026:41988 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

RLSA-2026:41906 Important: httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 Apache HTTP Server: modrewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation CVE-2026-24072 http...

httpd security, bug fix, and enhancement update

An update is available for httpd. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The httpd packages provide the Apache HTTP Server, a powerful, efficient, and...

CVE-2026-47247

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. This vulnerability allows a remote attacker to leak process heap memory by uploading a specially crafted AVIF or HEIC image file to a server-side image processor. The attacker can then recover sensitive heap data, such ...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65593

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...