24821 matches found
GHSA-HV7X-3X78-GX53 n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint
Impact The POST /workflows/workflowId/test-runs/new endpoint authorized access using workflow:read rather than workflow:execute. An authenticated user with read-only access to a workflow could trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner. Th...
Grimoire
書 — The Pentesterʼs Spellbook Answer the questions. Unleash th...
MAL-2026-5908 Malicious code in chain-chai-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...
Malicious code in chain-chai-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...
Security Bulletin: IBM Engineering Lifecycle Management - Engineering Test management is impacted by multiple vulnerabilities
Summary A vulnerability has been identified in jackson-databind library, which is used in IBM Engineering Lifecycle Management - Engineering Test management Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource...
PT-2026-56442
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 Description An authorization bypass exists in the Evaluations feature within the 'POST /workflows/workflowId/test-runs/new' endpoint. The system incorrect...
PT-2026-53033
Impact The POST /workflows/workflowId/test-runs/new endpoint authorized access using workflow:read rather than workflow:execute. An authenticated user with read-only access to a workflow could trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner. Th...
Malicious Package
Overview sn-internal-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2026-36749
An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature...
@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +118 more potentially affected by CVE-2026-53633 via vitest (>=4.0.0-beta.7, <=4.1.7)
vitest NPM version =4.0.0-beta.7, =0.0.3, =0.2.0, =0.0.21, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.282 and more Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITEST-17375131...
CVE-2026-12222
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function modwebd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs...
CVE-2026-12222
A vulnerability was determined in Yealink SIP-T46U 108.86.0.118. Affected is the function modwebd.BlueToothTest of the file /api/inner/bttest of the component Web FastCGI Service. Executing a manipulation of the argument btMac/pin/reserved can lead to stack-based buffer overflow. The attack needs...
CVE-2026-36933: Improper Access Control
An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature...
PT-2026-49289
Name of the Vulnerable Software and Affected Versions Boyleep K11, y108 version 2.3.0.11291 Description A flaw in the factory test feature allows an attacker with physical proximity to the device to execute arbitrary code. Recommendations At the moment, there is no information about a newer versi...
CVE-2026-36933
An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature...
CVE-2026-36933
An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature...
FreeType Glyph Loader for Font Parsing Validation
This Python script uses the FreeType bindings to load and inspect a specified TrueType font file and test glyph parsing behavior for a chosen glyph index. It initializes a font face, displays basic metadata such as the font family name and glyph count, then attempts to load a target glyph using...
CVE-2026-36933
The Boyleep K11, y108 running firmware version v.2.3.0.11291 is vulnerable to an improper access control flaw within its factory test feature . A physically proximate attacker can leverage this issue to achieve arbitrary code execution on the device. No information is currently available regardin...
MAL-2026-5748 Malicious code in chai-utils-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64edd573a9e5fdef8dcde78f5b0c9fa00521f232b886be838104741d1e0535f7 Package name 'chai-utils-test' impersonates the popular 'chai' assertion library and ships a cloned chai source tree. The declared main index.js call...