CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-86073

n8n , an open source workflow automation platform, is affected by a per-resource OAuth consent bypass prior to versions 2.37.7 and 2.38.1 . The OAuth token endpoint bound the initial access token to the consented resource but did not bind the refresh token ; upon refreshing, it only verified the ...

CVE-2026-61517 Netis NX10 OS Command Injection via Ping Diagnostic Handler

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-53796

A time-of-check to time-of-use TOCTOU race condition in rsync's non-daemon receiver allows a local attacker to compromise data integrity. By substituting a symbolic link for a destination path component during directory processing, an attacker can redirect file writes to unintended locations...

CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

WordPress Accept Stripe Payments plugin < 2.1.4 - Unauthenticated Product Substitution vulnerability

Unauthenticated Product Substitution vulnerability discovered by Nguyen Huu Do in WordPress Plugin Stripe Payments versions 2.1.4...

CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

CVE-2026-81424

The Accept Stripe Payments WordPress plugin before 2.1.4 contains an unauthenticated product substitution vulnerability (classified as an IDOR ). The plugin fails to verify that the product fulfilled at checkout matches the product for which the authoritative payment was actually made, checking o...

CVE-2026-85672

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85672 zerox 1.1.20 OS Command Injection via Document URL File Extension

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

EUVD-2026-71128

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

EUVD-2026-71116

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass in the _validate_command_with_operators function. When ALLOW_SHELL_OPERATORS is enabled, an attacker can inject shell command substitution syntax such as $(...) or backticks to execute commands that are not on the ALLOWED_COMMANDS allowlist...

CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-79630

The WPFunnels WordPress plugin prior to 3.13.0 contains an unauthenticated price manipulation vulnerability in its checkout order-bump feature. The plugin fails to verify that the product ID submitted via an order bump matches the product for which the bump's discount was configured. An unauthent...

CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution

The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...

GHSA-2MW5-23GM-PCCQ OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...