1251 matches found
BIT-ARGO-WORKFLOWS-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...
CVE-2026-48036
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...
CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...
CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...
CVE-2026-16799
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...
CVE-2026-16799
Affected product: Devolutions PowerShell Universal (versions 2026.2.2 and earlier). Vulnerability: improper access control in automation tests and workflows features, enabling an authenticated user with only the Reader role to execute automation tests and modify workflow properties due to missing...
EUVD-2026-48606
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...
CVE-2026-16799
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...
PT-2026-64308
Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper access control within the automation tests and workflows features allows an authenticated user assigned the Reader role to execute automation tests and modify...
CVE-2026-16221 vulnerabilities
Vulnerabilities for packages: vitess, renovate, gemini-cli, unleash, wazuh-dashboard-fips, tileserver-gl, opensearch-dashboards, librechat, yaml-language-server, argo-workflows, langfuse, langfuse-fips, unleash-proxy, unleash-fips, opensearch-dashboards-fips, kibana, tileserver-gl-fips...
GHSA-V2HH-GCRM-F6HX vulnerabilities
Vulnerabilities for packages: vitess, renovate, gemini-cli, unleash, wazuh-dashboard-fips, tileserver-gl, opensearch-dashboards, librechat, yaml-language-server, argo-workflows, langfuse, langfuse-fips, unleash-proxy, unleash-fips, opensearch-dashboards-fips, kibana, tileserver-gl-fips...
GHSA-V2HH-GCRM-F6HX vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, tileserver-gl, renovate, langfuse, yaml-language-server, argo-workflows, vitess...
CVE-2026-16221 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, tileserver-gl, renovate, langfuse, yaml-language-server, argo-workflows, vitess...
NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...
EUVD-2026-42269
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation...
Incorrect Authorization
Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization via the Execute Sub-workflow. An attacker can access unauthorized credentials by referencing credential IDs within inline workflow JSON, bypassing intended access controls. Note: Thi...
EUVD-2026-42612
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...
GHSA-JPJM-C3R5-Q96R vulnerabilities
Vulnerabilities for packages: argo-cd, crossplane-provider-aws-amp, crossplane-provider-aws-rum, teleport-operator-fips, syncthing-fips, trident, gptscript, cloudnative-pg-fips, beats, cue-fips, rancher, spire-server-fips, jetstream-controller, crossplane-provider-aws-acm-fips, kube-oidc-proxy,...
CVE-2026-56852 vulnerabilities
Vulnerabilities for packages: argo-cd, crossplane-provider-aws-amp, crossplane-provider-aws-rum, teleport-operator-fips, syncthing-fips, trident, gptscript, cloudnative-pg-fips, beats, cue-fips, rancher, spire-server-fips, jetstream-controller, crossplane-provider-aws-acm-fips, kube-oidc-proxy,...
