PT-2026-93720

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description An improper control of code generation issue exists in the Modbus CSV import workflow. This allows a remote authenticated attacker to execute arbitrary Lua code on the device by using a...

CVE-2026-92788: Incorrect Authorization

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-73171: External Control of File Name or Path

Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a...

PT-2026-93262

Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description Insufficient validation of inputs within management and configuration workflows allows an authorized management request or configuration value to be interpreted as an operating-system...

Exposure of System-scoped credentials in workflow-multibranch

workflow-multibranch 841.vec5b9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing the use of System-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to...

CVE-2026-83209

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Workflow. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks o...

CVE-2026-83209

A vulnerability in Oracle Siebel CRM Development (component: Workflow ) affects supported versions 17.0 through 26.7 . An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to achieve takeover of the product, with high impact to confidentiality, integrity, and a...

EUVD-2026-79561

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Workflow. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks o...

CVE-2026-12752

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

CVE-2026-12742 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...

EUVD-2026-78870

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...

CVE-2026-12742 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls...

CVE-2026-12752

IBM Business Automation Workflow (containers and traditional) is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker with low privileges could exploit this to expose sensitive information or consume memory resources . The assigned CVSS 3.1 score...

EUVD-2026-78865

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

CVE-2026-12752 Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

CVE-2026-12752 Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (Java CPU August 2026)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

EUVD-2026-78794

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflowdispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tagversion and nodeversi...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

EUVD-2026-78159

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...