CVE-2026-15343

GitHub Enterprise Server (Dependabot updater container) contains a path traversal vulnerability that lets an attacker with code execution inside that container write to arbitrary repository paths, including .github/workflows/. The flaw arises because path validation did not properly enforce the e...

CVE-2026-15343

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation d...

Vulnerabilities handled in the n8n workflow automation platform

n8n has identified several vulnerabilities in its workflow automation platform, particularly in versions 2.10.1, 2.9.3, 1.123.22, and other related releases. These vulnerabilities affect various components of n8n, including Form nodes, Python Code nodes, JavaScript Task Runner sandboxes, Merge...

CVE-2026-9810

The AI Copilot WordPress plugin (versions before 1.5.4 ) contains a vulnerability where it fails to bind OAuth access tokens to a specific WordPress user. Because the plugin accepts any valid token as an administrator session, an unauthenticated attacker who completes the public OAuth flow can ex...

PT-2026-60846

Name of the Vulnerable Software and Affected Versions aws-healthomics-mcp-server versions prior to 0.0.36 Description Improper limitation of a pathname to a restricted directory in the linting tools of the AWS HealthOmics MCP Server allows an actor who can influence the MCP agent to write...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

CVE-2026-54526

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

EUVD-2026-45028

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-48863

A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI lengths. Processin...

CVE-2026-15008: Deserialization of Untrusted Data

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

CVE-2026-55576

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...

Improper Authorization

n8n-mcp is vulnerable to Improper Authorization. The vulnerability is due to insufficient tenant isolation in multi-tenant HTTP mode, which allows an authenticated tenant to access locally stored workflow version backups outside of its assigned tenant scope...

Improper Authorization

n8n-mcp is vulnerable to Improper Authorization. The vulnerability is due to insufficient tenant isolation of locally stored workflow version history, which allows an authenticated tenant to read or delete workflow backups belonging to other tenants, exposing sensitive configuration data and...

CVE-2026-55608

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...

CVE-2026-54052

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLEMULTITENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an...

CVE-2026-55576 MaaAssistantArknights: PR-title expression injection in release-preparation.yml

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...

CVE-2026-55576 MaaAssistantArknights: PR-title expression injection in release-preparation.yml

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...

EUVD-2026-44807

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLEMULTITENANT=true could allow an authenticated tenant to access default-scope workflowversions backups instead of being confined to...