Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 CVSS v3.1 score: 9.8/CVSS v4 score: 9.3, which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21...

CVE-2026-59206

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

CVE-2026-59206

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

CVE-2026-59206: Improperly Controlled Modification of Object Prototype Attributes

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138: Improper Control of Generation of Code

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2026-53438 via org.jenkins-ci.main:jenkins-core (1.577)

org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...

com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2026-53437 via org.jenkins-ci.main:jenkins-core (1.568)

org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...

com.nirima.jenkins.repository:jenkins-maven-plugin (1.3), com.nirima.jenkins.repository:pom (1.3) +39 more potentially affected by CVE-2026-53435 via org.jenkins-ci.main:jenkins-core (1.609.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.609.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.3 - com.nirima.jenkins.repository:pom 1....

net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.577)

org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...

com.nirima.jenkins.repository:jenkins-maven-plugin (1.3), com.nirima.jenkins.repository:pom (1.3) +39 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.609.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.609.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.nirima.jenkins.repository:jenkins-maven-plugin 1.3 - com.nirima.jenkins.repository:pom 1....

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67637 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.568) +24 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.568)

org.jenkins-ci.main:jenkins-core MAVEN version 1.568 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.sonymobile.jenkins.plugins.kerberos-sso:kerberos-sso =1.2, =1.4 -...

org.jenkins-ci.main:jenkins-test-harness (1.572), org.jenkins-ci.main:jenkins-war (1.572) +14 more potentially affected by CVE-2025-67639 via org.jenkins-ci.main:jenkins-core (1.572)

org.jenkins-ci.main:jenkins-core MAVEN version 1.572 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.572 - org.jenkins-ci.main:jenkins-war 1.572 -...

org.jenkins-ci.main:jenkins-test-harness (1.572), org.jenkins-ci.main:jenkins-war (1.572) +14 more potentially affected by CVE-2025-67638 via org.jenkins-ci.main:jenkins-core (1.572)

org.jenkins-ci.main:jenkins-core MAVEN version 1.572 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.572 - org.jenkins-ci.main:jenkins-war 1.572 -...