PT-2026-63352

n8n before 2.29.8 and 2.30.x before 2.30.1 affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger...

PT-2026-63349

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-62547

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

CVE-2026-61278

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow...

CVE-2026-61247

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

CVE-2026-60780

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successfu...

CVE-2026-60575

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow...

CVE-2026-60542

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component: Human Workflow. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to...

CVE-2026-60144

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow execut...

CVE-2026-60149

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Workflow...

CVE-2026-60143

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow...

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63143

Technical details (affected products, components, versions, exploitability) are not publicly available in the provided documents; monitor for updates.

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-62547

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

EUVD-2026-46419

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

CVE-2026-65055

Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filtersdata API endpoints on UserStory, Task, Issue, and Epic viewsets...

CVE-2026-47690

MeltanoHub (hub.meltano.com) had a vulnerability in versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173, where a pull_request_target workflow could exfiltrate the repository GITHUB_TOKEN with write permissions. The issue was fixed by the commit 923820de8f64d753951fbbd54f7282a3d5f751...