CVE-2026-87064

konflux-operator-tasks contains a flaw where GitHub workflows do not explicitly define their required permissions. This oversight allows workflows to inherit default access tokens that grant broader privileges than intended. Excessive permissions could potentially allow an attacker to gain unauth...

CVE-2026-87063

A flaw in konflux-operator-tasks allows a compromised distribution channel to substitute a malicious tkn CLI binary during the Continuous Integration process. The root cause is that the CI pipeline downloads the tkn CLI over the network without verifying its integrity via checksums or digital sig...

CVE-2026-87061

A flaw in olm-operator-konflux-sample 's bundle-hack/update_bundle.sh script allows it to continue execution after errors in critical data processing steps (e.g., skopeo or jq commands), potentially leading to data integrity issues within the system. Red Hat notes that mitigation is either unavai...

CVE-2026-87059

A flaw in olm-operator-konflux-sample affects the bundle builder stage, which installs and upgrades Python packages using pip without verifying versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leadi...

CVE-2026-87060

A flaw in olm-operator-konflux-sample stems from Renovate's automerge being configured too broadly, permitting a wide range of updates without sufficient scrutiny, while the critical base image ose-operator-registry is entirely excluded from update tracking. This combination creates an inconsiste...

CVE-2026-87056

CVE-2026-87056 affects operator-sdk-builder , where the repository lacks automated dependency-update configurations for its git submodules , Containerfile base image , and Tekton bundle references . This gap prevents the automatic flagging of stale or vulnerable dependencies, which could result i...

CVE-2026-87058

A flaw in olm-operator-konflux-sample (Konflux) leaves hermetic build mode disabled by default , allowing bundle builds to perform live network fetches. This permits external, unverified resources to be pulled during the build process, introducing a supply chain risk where resulting software arti...

CVE-2026-87055

A supply chain integrity flaw in operator-sdk-builder arises from the use of a mutable tag to identify its base container image in the Containerfile, rather than an immutable SHA256 digest. Because the tag can resolve to different image layers over time, the underlying base image may change unexp...

CVE-2026-87052

A flaw was identified in operator-foundry where the absence of automated dependency-update and vulnerability-scanning configurations in the repository increases the risk of undetected security vulnerabilities . This gap in automated security checks could lead to the inclusion of known vulnerable ...

CVE-2026-87051

A path-containment flaw in operator-foundry allows unauthorized file access beyond the intended build context confinement. The check that restricts file access relies on string-based validation only and fails to resolve symbolic links (symlinks) , enabling an attacker to create a symlink within t...

CVE-2026-86564

A flaw in DPDK lib/vhost results from missing length validation before reading command_data in the virtio-net control-queue handler , which can cause an out-of-bounds read and a host process crash . The CVSS v3.1 score is 3.3 (LOW) , with a local attack vector, low privileges required, no user in...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-18090

A heap out-of-bounds read vulnerability was identified in gdk-pixbuf , specifically in the uncompress() function that handles RLE-encoded Apple Icon Image (.icns) data. The function fails to validate the source buffer's boundaries during decompression, allowing a local attacker who supplies a cra...

CVE-2026-53581

OPNsense is a FreeBSD-based firewall and routing platform. A path traversal vulnerability in the NTP configuration module allows an attacker with access to NTP settings to manipulate the GPS or PPS serial port parameter , escaping the intended directory and forcing the system to write user-contro...

CVE-2026-87062

A flaw was found in konflux-operator-tasks , where GitHub Actions are configured to reference mutable tags or branches instead of specific, immutable commit SHAs. A remote attacker who compromises the referenced mutable tag or branch could introduce malicious code into the build process , potenti...

CVE-2026-87057

CVE-2026-87057 affects olm-operator-konflux-sample , where build pipelines reference runtime base images using mutable floating tags instead of immutable SHA256 digests. This allows the content of base images to be altered without detection, potentially introducing malicious code or unexpected ch...

CVE-2026-87054

CVE-2026-87054 affects operator-sdk-builder , where the containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries not explicitly listed. This causes signature verification to be skipped for images pulled from unlisted registries, potentially allow...

CVE-2026-87053

operator-sdk-builder is affected by a flaw in its Containerfile configuration that causes the final built container image to run with root privileges by default . This increases the attack surface, as any process executed within the container has elevated permissions, and a compromised container ...

CVE-2026-87050

CVE-2026-87050 affects operator-foundry , where GitHub Actions and reusable workflows are referenced using mutable tags (e.g., @v0, @v4) instead of pinned commit SHAs. This allows an attacker to potentially alter the code executed in the CI pipeline through an upstream compromise or by re-pointin...

CVE-2026-53637

CVE-2026-53637 is an improper workflow enforcement vulnerability in Sylius (an open-source eCommerce framework on Symfony). The affected component is the cart FormComponent , a Symfony UX LiveComponent. When an order is completed while the cart page remains open, the stale component fails to dete...

CVE-2026-53638

Sylius (open-source eCommerce framework built on Symfony) is affected by an authorization bypass in the shop account API. The endpoint PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}—used by an authenticated customer to change the payment method of an unpaid order—fails to val...

CVE-2026-53639

Sylius (Open Source eCommerce Framework on Symfony) versions 2.0.0 through before 2.0.18, 2.1.15, and 2.2.6 are affected by an IDOR on Shop Payment Request API endpoints. The GET/PUT /api/v2/shop/payment-requests/{hash} and POST /api/v2/shop/orders/{tokenValue}/payment-requests endpoints perform ...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-83950

This CVE entry is reserved , indicating technical details have not yet been publicized. The only reference is a ZDI blog post on the September 2026 security update review. Monitor for updates as the disclosing organization publishes specifics.

CVE-2026-53933

Maravel , a PHP dependency-injection framework, is vulnerable to side-channel information disclosure via dynamic route fuzzing in versions prior to 10.73.1 . When routes are compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw placeholder key is mistakenly registered into the fl...

CVE-2026-81904

Concrete CMS below 9.5.3 is affected by a missing authorization flaw in the asset registration for sub-blocks within a Stack , Container , or layout area. The system registered view assets for every sub-block without verifying whether the requesting user had permission to view that sub-block, all...

CVE-2026-86075

n8n , an open-source workflow automation platform, contains an unauthenticated storage exhaustion vulnerability in its OAuth Dynamic Client Registration endpoint. Prior to versions 2.37.7 and 2.38.2 , the endpoint properly bounded redirect_uris but accepted arbitrarily large client_name and grant...

CVE-2026-86076

n8n , an open-source workflow automation platform, is affected by an expression sandbox escape in the Editor-UI. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the expression compiler sanitizer (the PrototypeSanitizer hook in packages/workflow/src/expression-sandboxing.ts) resolved through dy...

CVE-2026-86077

n8n , an open-source workflow automation platform, contained an authorization flaw in the /chat WebSocket route (specifically the canResumeOverChat function in chat-execution-manager.ts). Prior to versions 2.37.7 and 2.38.2 , a resumeToken issued to an anonymous form submitter could be replayed o...

CVE-2026-86078

n8n (open-source workflow automation platform) is affected by a prototype pollution vulnerability in the Instance AI workflow summary feature prior to versions 2.37.7 and 2.38.2 . The function summarizeWorkflowStructure (in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts) trea...

CVE-2026-86079

CVE-2026-86079 affects n8n , an open-source workflow automation platform. The Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths without the required toPathSegment encoding (missing in GenericFunctions.ts). An i...

CVE-2026-86080

n8n , an open source workflow automation platform, is affected by a fail-open signature verification flaw in its GitHub Trigger . When GitHub returns HTTP 422 and the node reuses an existing webhook, the generated webhook secret is discarded , leaving workflow static data with a webhookId but no ...

CVE-2026-86081

n8n , an open-source workflow automation platform, is vulnerable to Regular Expression Denial of Service (ReDoS) in its Git node clone operation. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the default N8N_BLOCK_FILE_PATTERNS regex (^(./).git(/.)$) permitted catastrophic backtracking when ...

CVE-2026-86082

n8n , an open source workflow automation platform, is affected by a domain-restriction bypass in the OpenAI Chat Model node . The root cause is that the searchModels code path in loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check, meaning the credential allowed-domain restrictions en...

CVE-2026-86083

n8n , an open-source workflow automation platform, is affected by a sandbox escape in its legacy expression engine. The root cause is that the engine called the mutable global JSON.stringify while generating source text for synthetic string literals and timezone interpolation. A crafted expressio...

CVE-2026-86084

n8n is an open-source workflow automation platform. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the public OIDC login and callback endpoints could complete authentication and issue valid sessions even when OIDC was not the active authentication method. The root cause lies in packages/cli/s...

CVE-2026-86085

n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 suffered a cross-tenant information disclosure vulnerability in its role assignment endpoints (/rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members). The affected controller (packages/cli/src/c...

CVE-2026-86993

n8n is an open-source workflow automation platform. Prior to 1.123.76 , 2.37.7 , and 2.38.2 , a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check . A user with a custom global role carrying Log Streami...

CVE-2026-86994

n8n , an open-source workflow automation platform, contained a missing userId filter that allowed cross-user information disclosure. The /rest/active-workflows endpoint returned every active workflow ID on the instance to any authenticated member regardless of sharing permissions, and lifecycle p...

CVE-2026-15887

CVE-2026-15887 affects IBM WebSphere Application Server (versions 8.5 and 9.0) with a blind server-side request forgery (SSRF) vulnerability triggered when processing SOAP requests . Classified as CWE-918 , the flaw allows a remote attacker with low privileges to cause the server to send outbound...

CVE-2026-16190

CVE-2026-16190 affects IBM WebSphere Application Server (versions 9.0 and 8.5) with an authorization bypass vulnerability (CWE-862: Missing Authorization). The CVSS 3.1 score is 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating an adjacent-network attack with high complexity and no privileges...

CVE-2026-16435

CVE-2026-16435 affects IBM WebSphere Application Server (versions 8.5 and 9.0) with an authentication bypass vulnerability when using XD or Intelligent-Management features. The root cause is CWE-650: Trusting HTTP Permission Methods on the Server Side , rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H...

CVE-2026-16185

CVE-2026-16185 affects IBM WebSphere Application Server (versions 9.0 and 8.5), allowing a remote attacker to bypass authentication on an admin console servlet due to a missing authorization flaw (CWE-862). The CVSS 3.1 base score is 6.4 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H), indicating a network...

CVE-2026-86995

CVE-2026-86995 affects n8n , an open-source workflow automation platform. The Git node validated the repository parameter for fetch/pull operations, but its setUpstream function wrote a branch..remote value into the repository configuration without validation. A subsequent fetch or pull then reso...

CVE-2026-86996

n8n (open-source workflow automation platform) is affected by a policy bypass in its Agent workflow tool . Prior to 2.37.7 and 2.38.2 , the "This workflow can be called by" setting was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. The root cause...

CVE-2026-11545

IBM WebSphere Application Server (versions 8.5 and 9.0) is affected by a privilege escalation vulnerability stemming from missing authorization checks (CWE-862). A remote attacker could obtain sensitive information from the administrative console. The CVSS 3.1 base score is 3.7 (AV:N/AC:H/PR:N/UI...

CVE-2026-11710

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability (CWE-444) caused by improper handling of Content-Length headers . The vulnerability allows an attacker with no prior access (network attack, high complexity) to achieve high confidentiality impact and low ...

CVE-2026-81984

Adobe Acrobat Reader is affected by a Use After Free (CWE-416) vulnerability that can lead to disclosure of sensitive memory . An attacker must get a victim to open a malicious file, and exploitation requires user interaction with a local attack vector . The CVSS 3.1 score is 5.5 (MEDIUM) with hi...

CVE-2026-81991

Acrobat Reader is affected by an out-of-bounds read vulnerability (CWE-125) that could lead to disclosure of sensitive memory . Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 score is 5.5 (Medium) , reflecting a local attack vector with low complexity, ...

CVE-2026-81989

Adobe Acrobat Reader is affected by a Use After Free (CWE-416) vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction , as the victim must open a malicious file. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vect...