PT-2026-56443

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a shared workflow can use the Public API to ret...

CVE-2026-56776: Incorrect Authorization

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/workflowId/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real...

PYSEC-2026-1216 BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the...

PT-2026-56166

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description Information regarding this issue is limited to its discovery through AI-driven research workflows focused on Web3 security. Recommendations At the moment, there is no information about a newer...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines, argo-workflows, kubeflow-pipelines-fips...

EUVD-2026-41248

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-11592

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-11592 Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...