CVE-2026-13107

IBM Business Automation Workflow (containers and traditional) versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, and 26.0.0-IF001 may use programming model artifacts in Advanced custom applications that are vulnerable to XML External Entity (XXE) injection by default (CWE-611). A remote authentic...

CVE-2026-13107 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

CVE-2026-13107 Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (including Java)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-90787

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

CVE-2026-90787 Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

CVE-2026-90787

A vulnerability in Soarkey StudentManagement (up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e) affects the Registration Workflow component. The root cause is improper privilege management in the RegisterServlet.doPost function of code/WebContent/register.html, triggered by manipulation of t...

EUVD-2026-77479

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

CVE-2026-90787 Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

CVE-2026-90787 Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

PT-2026-91220

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

PT-2026-91747

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 8.3.0 through 9.5.2 Description Stored calendar event names are saved without sanitization and rendered without HTML escaping in the workflow approval and deletion notifications within the dashboard "Waiting For Me" block...

PT-2026-91461

Name of the Vulnerable Software and Affected Versions IBM Business Automation Workflow affected versions not specified Description Programming model artifacts in both containerized and traditional deployments may be susceptible to XML Entity Injection attacks by default. This occurs when an...

CVE-2026-12756: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-13107: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

CVE-2026-90787: Improper Privilege Management

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

osmedeus v5.1.1

Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...

CVE-2026-78135: Improper Enforcement of Behavioral Workflow

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass...

EUVD-2026-73162

n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution...

GHSA-679F-58PQ-4V2C n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the...