CVE-2026-56360

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

PYSEC-2026-1216 BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GHSA-7VF8-2CR6-54MF vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-fips...

CVE-2026-42183 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-fips...

GHSA-P4GQ-3VXJ-F4JQ vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-fips...

GHSA-XCHC-CQWG-G76Q vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-fips...

CVE-2026-42297 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-fips...

CVE-2026-42295 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines-driver-fips, argo-workflows, kubeflow-pipelines, kubeflow-pipelines-fips...

EUVD-2026-41248

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

CVE-2026-11592

The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifying that a user is authorized to perfor...

DRUPAL-CONTRIB-2026-068

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the use...

DRUPAL-CONTRIB-2026-067

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution incurring LLM spend and tool side effects or send messages into other...

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution incurring LLM spend and tool side effects or send messages into other...

PT-2026-55225

Name of the Vulnerable Software and Affected Versions FlowDrop versions 0.0.0 through 1.6.0 Description A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently re-evaluate human-in-the-lo...