CVE-2026-72764 n8n before 1.123.67 Module Cache Poisoning via Code Node

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

CVE-2026-72764 n8n before 1.123.67 Module Cache Poisoning via Code Node

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

PT-2026-70937

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

PT-2026-70166

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions before 1.123.67, 2.31.5, and 2.32.1, a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting...

PT-2026-70266

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10...

PT-2026-70843

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

PT-2026-70834

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request to RequestViewSet.create with inconsistent task and job IDs, and because the task ID determines...

OrkesConductor 3.30.2 Remote Code Execution

OrkesConductor version 3.30.2 suffers from a remote code execution vulnerability. !/usr/bin/env python3 Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution CVE: CVE-2026-58138 Date: 2026-07-10 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram:...

CVE-2026-68245

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

CVE-2026-68421

The CVE-2026-68421 entry concerns the Linux kernel sched_ext path. The issue arises when put_prev_task_scx() warns about a runnable task dropping to a lower sched_class without ENQ_LAST, due to core scheduling forcing idle via an SMT sibling’s core_pick path which bypasses balance_one(). The miti...

CVE-2026-68245

CVE-2026-68245 affects the Linux kernel’s DRM/amdgpu component. The issue is a use-after-unlock: a vm pointer retrieved via amdgpu_vm_get_vm_from_pasid() is used after xa_unlock_irqrestore releases the lock, leaving the pointer vulnerable to modification. The documented fix removes the dependency...

CVE-2026-68245 drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

CVE-2026-13600

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

EUVD-2026-54971

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...

CVE-2026-19378

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...

Linux Distros Unpatched Vulnerability : CVE-2026-68421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on...

CVE-2026-19378 code-projects Task Management System CommentSave.php cross site scripting

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...

CVE-2026-19345

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...

CVE-2026-19344

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/commentcountuser.php. The manipulation of the argument taskid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

EUVD-2026-54914

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...