CVE-2026-103247

Versions of n8n before 1.123.80 are vulnerable to a credential tampering flaw caused by duplicate node IDs . Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to bypass the workflow credential tamper guard. This allows the attacker to retain victim ...

CVE-2026-103247 n8n before 1.123.80 Credential Tampering via Duplicate Node IDs

n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...

bugbounty-arsenal-resources

BugBounty Arsenal 리소스 버그바운티 헌터와 웹 보안 연구자를 위한 선별된 워크플로, 도구 및 참고 자료. BugBounty Arsenal이란? BugBounty Arsenal은 리콘 워크플로, 엔드포인트 발견 및 보안 테스트 유틸리티에 중점을 둔 실용적인 웹 테스트 플랫폼입니다. 목표는 복잡한 로컬 설정 없이 반복적인 웹 테스트 작업을 간소화하는 것입니다. 기능 리콘 워크플로 엔드포인트 발견 서브도메인 열거 퍼징 지원 보고 도구 웹 테스트 유틸리티 라이브 데모 https://bugbounty-arsenal.net...

Playbooks

目次 TOC IR プレイブック このリポジトリには、当社SOCのすべてのインシデント対応（IR）プレイブックとワークフローが含まれています。 各フォルダーには、NIST - 800.61 r2 に従って6つのセクションに分割されたプレイブックが含まれています。 1- 準備 このセクションには以下の情報を含める必要があります。 すべてのアセットのリスト サーバー エンドポイント（重要なものを含む） ネットワーク アプリケーション 従業員 セキュリティ製品 ベースライン コミュニケーション計画 どのセキュリティイベント しきい値 セキュリティツールへのアクセス方法 アクセス権の付与方法...

CVE-2026-71899

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-71897

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

EUVD-2026-88816

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-71899

Apache DolphinScheduler versions 3.2.0 before 3.4.3 are susceptible to a missing authorization vulnerability in the query-dynamic-sub-workflows API. The root cause is that the API fails to verify if an authenticated user possesses the necessary permissions to access the specific workflows being q...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

BIT-ARGO-WORKFLOWS-2026-93991 Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a...

CLEANSTART-2026-ZQ97544 path-to-regexp turns path strings into a regular expressions

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

CLEANSTART-2026-NW68824 Impact: In body-parser versions prior to 1

Security vulnerability affects the argo-workflows package. Impact: In body-parser versions prior to 1...

CLEANSTART-2026-WO79894 websocket-driver is a WebSocket protocol handler with pluggable I/O

Security vulnerability affects the argo-workflows package. websocket-driver is a WebSocket protocol handler with pluggable I/O...

CLEANSTART-2026-HE25090 Browserslist is a configuration tool for sharing target browsers and Node

Security vulnerability affects the argo-workflows package. Browserslist is a configuration tool for sharing target browsers and Node...

CLEANSTART-2026-RQ08724 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects...

CLEANSTART-2026-CI28358 minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Security vulnerability affects the argo-workflows package. minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects...

CLEANSTART-2026-RI71860 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the argo-workflows package. js-yaml is a JavaScript YAML parser and dumper...

CLEANSTART-2026-UD61753 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU

Security vulnerability affects the argo-workflows package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...

CLEANSTART-2026-FQ89941 form-data is a library for creating readable multipart/form-data streams

Security vulnerability affects the argo-workflows package. form-data is a library for creating readable multipart/form-data streams...