EUVD-2026-85614

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...

CVE-2026-76804

A flaw was found in Nuclei, a vulnerability scanner. An untrusted workflow, which is a set of instructions for the scanner, could bypass a security control designed to restrict file access. This bypass allows the workflow to load templates that read local files from the scanner host, even when fi...

EUVD-2026-84982

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-92928: Use of Hard-coded Credentials

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-82406: Improper Enforcement of Behavioral Workflow

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

CVE-2026-92928

The OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be modified, disabled, or rotated. This design flaw, present since at least firmware 2.2.3.4 , allows an unauthenticated remote attacke...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks approver-group membership, change permission on the object under review, one-response-per-user are enforced only in the approve/deny actions on...

GHSA-QGW5-7J4F-FG97 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

A vulnerability in Nuclei's workflow template loader allows file: protocol templates to execute without the -file flag, bypassing a security gate that is meant to prevent local file reads on the scanner host. Affected Component The issue is in the workflow template loading path. The main template...

CVE-2026-76804

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804

The vulnerability scanner Nuclei contains a flaw in its workflow template loading path, affecting versions 3.0.0 through 3.10.0 . The issue arises because the workflow loader fails to enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. Consequently,...

EUVD-2026-84554

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-76804 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a...

CVE-2026-65126

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure...

CVE-2026-65126

The NVIDIA Infrastructure Controller for Linux is affected by CVE-2026-65126 , which involves the improper enforcement of a behavioral workflow (CWE-841). A successful exploit could result in data tampering , denial of service , and information disclosure . This vulnerability affects versions 0 t...