EUVD-2026-47641

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

EUVD-2026-47504

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite component: Data Removal Tool. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources...

EUVD-2026-46466

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite component: Data Removal Tool. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources...

Plone 3.3.x < 4.3.3 Multiple Vulnerabilities (HF 20131210)

The version of Plone installed on the remote host is 3.3.x and prior to 4.3.3. It is, therefore, affected by the following vulnerabilitites: - Products/CMFPlone/FactoryTool.py is initialized in class scope. CVE-2013-7060 - Products/CMFPlone/CatalogTool.py allows remote administrators to bypass...

The vulnerability of the XML analysis mechanism in security systems and the Nessus vulnerability assessment tool allows attackers to execute arbitrary SQL queries.

The vulnerability of the XML analysis mechanism of the security system and the Nessus vulnerability assessment tool is related to the lack of measures taken to protect the SQL query structure during the processing of the nessus file. Exploiting this vulnerability allows an attacker to execute...

PT-2026-63494

Name of the Vulnerable Software and Affected Versions IZArc version 4.6 Description An issue in the unrar.dll component allows attackers to perform path traversal, a technique used to access files and directories that are stored outside the intended folder. Recommendations At the moment, there is...

CVE-2026-62466

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite component: Data Removal Tool. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources...

CVE-2026-61110

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite component: ADPatch. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successf...

CVE-2026-46954

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite component: Data Removal Tool. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources...

CVE-2026-62466

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite component: Data Removal Tool. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources...

CVE-2026-63920

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

CVE-2026-65056

CVE-2026-65056 describes a server-side request forgery in mcp-webresearch 0.1.7. The vulnerability arises because visit_page validates only URL protocol and does not filter private or reserved IP ranges, enabling an attacker to access internal network services by supplying loopback, link-local, o...

CVE-2026-30632

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the createdoc tool...

Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-38969 DESCRIPTION: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that...

Exploit for CVE-2026-63030

WP2Shell Detector and Validation PoC !License: MIThttps:/...

CVE-2026-15829

CVE-2026-15829 affects googleapis/mcp-toolbox (bigquery-forecast). The prebuilt forecasting tool interpolates client-controlled parameters (data_col, timestamp_col, id_cols) into a generated AI.FORECAST query via fmt.Sprintf without re-validation, enabling SQL injection (CWE-89) and a security bo...

EUVD-2026-46317

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-47391

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to...

CVE-2026-47391

PraisonAI’s first-party A2A example exposes an unauthenticated /a2a JSON-RPC surface and registers a calculate(expression) tool implemented via Python eval(), bound to 0.0.0.0. A remote attacker can send message/send to a2a, causing the LLM to invoke the unsafe tool and potentially execute arbitr...