CVE-2025-68613

CVE-2025-68613 n8n 是一款开源的工作流自动化平台。自 0.211.0 版本起至 1.120.4、1.121.1 和 1.122.0 之前的版本，其工作流表达式评估系统中存在一个严重的远程代码执行（RCE）漏洞。在某些条件下，由认证用户在工作流配置期间提供的表达式可能会在未充分与底层运行时隔离的执行上下文中被评估。经过身份验证的攻击者可利用此行为，以 n8n 进程的权限执行任意代码。成功利用该漏洞可能导致受影响实例被完全控制，包括未经授权访问敏感数据、修改工作流以及执行系统级操作。此问题已在 1.120.4、1.121.1 和 1.122.0...

CVE-2024-55374

CVE-2024-55374 Redcap 14.3.13 存在用户枚举漏洞，因为它会根据用户是否存在而返回不同的错误消息。这允许攻击者发送多个 HTTP 身份验证请求来执行暴力破解攻击。尽管存在一种缓解此攻击向量的保护机制，但该机制本身反而允许攻击者推断出应用程序中有效用户的存在。...

CVE-2026-88252

A flaw was found in sssd. A local user can cause a Denial of Service...

PT-2026-107699

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description Improper input validation in the REST API allows a user wi...

Keycloak 26.7.3 <= 26.8.0 User Session Note Mapper Access Token Exposure (CVE-2026-105302)

The version of Keycloak installed on the remote host is 26.7.3 through 26.8.0. It is, therefore, affected by a vulnerability where a User Session Note protocol mapper can expose upstream identity provider access tokens to managed clients, allowing a client to obtain a token it was not intended to...

PT-2026-107430

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system...

PT-2026-107473

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

PT-2026-107414

The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including...

PT-2026-107383

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

PT-2026-107401

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

PT-2026-107468

Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the...

PT-2026-107516

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot entry ID in a POST /api/v2/workoutlog/ request. The slot entry foreign key is not includ...

PT-2026-107753

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

PT-2026-107693

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A low-privileged user without admin or power roles can cause a denial of service against a REST API...

CVE-2025-9816

CVE-2025-9816 WP-Statistics 插件上的存储型 XSS 扫描器（检测与 PoC） “WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin 插件（用于 WordPress）在包括 14.5.4 在内的所有版本中，由于对输入清理和输出转义不足，存在通过 User-Agent 头进行的存储型跨站脚本漏洞。这使得未经身份验证的攻击者能够在页面中注入任意 Web 脚本，当用户访问被注入的页面时这些脚本将执行。” 如何使用 use virtual enviroment & active pip...

CVE-2025-68613

CVE-2025-68613 — n8n 工作流自动化表达式引擎隔离失效 作者不对因使用或滥用本研究造成的任何损害承担责任 严格仅供教育和防御用途 描述 本仓库包含对漏洞 CVE-2025-68613 的实验室级分析和安全概念验证 ，该漏洞影响工作流自动化平台 n8n 。 从 0.211.0 开始到 1.120.4 之前的版本，以及 1.121.0–1.121.1 包含一个 表达式评估系统 中的严重缺陷。 在特定条件下，由经过身份验证的用户提供的表达式可能会在缺乏适当隔离 的运行时上下文中被评估，理论上可以实现远程代码执行 RCE。 本仓库不提供 利用代码 它提供： 版本指纹识别 漏洞检...

CVE-2025-492025

CVE-2025-492025 Aviso de Seguridad: CVE-2025-492025 Resumen Se ha identificado una vulnerabilidad en Copilot AI que provoca que se incluya un hipervínculo no deseado en la sección "link source" cada vez que Copilot realiza una consulta web. Este problema provocó que los usuarios hicieran clic en...

CVE-2026-106501

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...