CVE-2026-103273

Ghost versions 4.3.0 before 6.58.0 are affected by an authentication bypass vulnerability. The root cause is incorrect authorization via staff tokens, which allows lower-privilege staff users to bypass post editing restrictions. Specifically, attackers possessing staff credentials can leverage th...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 are vulnerable to a content API vulnerability that enables unauthenticated visitors to bypass content restrictions. Attackers can directly query the content API to retrieve gated post content without providing any authentication. No specific exploit details...

CVE-2026-103269

Ghost versions 5.3.0 before 6.62.0 are impacted by a missing authorization vulnerability. This flaw allows an authenticated site member to access and read excerpts of posts that are otherwise restricted as gated content . No specific exploit information or remediation steps are provided in the do...

CVE-2026-103268

Ghost versions before 6.62.0 are vulnerable to an authentication bypass flaw. This vulnerability allows users with suspended staff credentials to reactivate their accounts and restore original privileges by performing a self-service password reset . No specific exploit links or in-the-wild exploi...

CVE-2026-103267

Ghost versions before 6.62.0 are vulnerable to an authentication bypass during the staff invite acceptance process. This flaw allows users to specify arbitrary email addresses when creating an account. Specifically, attackers can utilize leaked invite tokens to register with attacker-controlled e...

CVE-2026-103266

Ghost versions 5.2.0 through 6.62.0 are vulnerable to an unauthenticated flaw in the Stripe Checkout flow . An attacker can abuse this flow to attach a paid subscription to an existing member, modify that member's name, and inject malicious content into newsletters sent to them. Depending on the ...

CVE-2026-103265

Fleet versions before 4.89.0 are vulnerable to an information disclosure flaw in the commands/results endpoint. The root cause is a failure to properly filter MDM command results by team authorization. Consequently, team-scoped users can access MDM command results for hosts belonging to other tea...

CVE-2026-103264

Fleet versions before 4.87.0 are vulnerable to an authentication bypass in the device API. The root cause is that the API accepts hostnames and hardware serials as authentication tokens alongside device UUIDs. Unauthenticated attackers capable of guessing these non-secret identifiers can authenti...

CVE-2026-103263

The Tornado web framework (versions before 6.5.9 ) contains a path traversal vulnerability within the StaticFileHandler component. The root cause is that the handler follows symbolic links located inside the static root directory without verifying if the resolved target remains within that direct...

CVE-2026-103262

Tornado versions before 6.5.9 are vulnerable to a Denial of Service (DoS) attack via the CurlAsyncHTTPClient component. The root cause is an unbounded memory accumulation vulnerability where the client fails to enforce limits on incoming response sizes. A remote malicious server can exploit this ...

CVE-2026-103261

The Tornado web framework versions prior to 6.5.9 are vulnerable to a Denial of Service (DoS) condition. The root cause is a lack of limits on the number of query string fields processed within the HTTPServerRequest.__init__ component. A remote, unauthenticated attacker can exploit this by sendin...

CVE-2026-103260

The n8n workflow automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to an approval bypass in the Send and Wait node's Approve Within Chat mode. The root cause is a lack of verification regarding the identity or approval permissions of the requester. Consequently, una...

CVE-2026-103258

The n8n workflow automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to a filter bypass due to unescaped parameter interpolation in the SendGrid , Freshservice , and ServiceNow nodes. By binding vulnerable node parameters to untrusted external input, an attacker can b...

CVE-2026-103259

The n8n application versions before 2.39.6 and 2.40.x before 2.40.1 are vulnerable to a session token leakage in the Dynamic Credentials authorize and revoke endpoints. Attackers who possess resolver registration capability can capture collaborators' session tokens by configuring a fallback resol...

CVE-2026-103257

The automation platform n8n is vulnerable to a path traversal vulnerability in versions prior to 1.123.80, 2.39.6, and 2.40.1. The root cause is a failure to validate resource identifiers within the n8n node. An attacker can craft malicious resource IDs to redirect API calls to unintended targets...

CVE-2026-103255

Versions of n8n prior to 1.123.80, and from 2.0.0 before 2.39.6 and from 2.40.0 before 2.40.1, are vulnerable to a path traversal and query injection flaw in the Supabase node . The root cause is the lack of validation when the tableId parameter is inserted into request paths. Attackers can explo...

CVE-2026-103256

The n8n automation tool (versions before 2.39.6 and 2.40.x before 2.40.1 ) is vulnerable to a credentials leak via a preAuthentication Hook. The flaw resides in the Wekan and Baserow username-and-password credential types, where the application fails to properly validate host fields. Attackers wi...

CVE-2026-103254

The software n8n is vulnerable to a path traversal vulnerability in its signed resume URL generation for Send-and-Wait approvals . Affected versions include those before 1.123.80 , 2.0.0 before 2.39.6 , and 2.40.0 before 2.40.1 . An attacker with workflow creation permissions can exploit unresolv...

CVE-2026-103253

The n8n automation tool (versions before 1.123.80, 2.0.0 to 2.39.6, and 2.40.0 to 2.40.1) is vulnerable to an SQL injection flaw in the Oracle Database node 's Delete Table Drop operation. The root cause allows attackers to inject single quotes into table or schema fields to append arbitrary SQL ...

CVE-2026-103252

Versions of n8n prior to 1.123.80, 2.39.6, and 2.40.1 are vulnerable to an authorization bypass in the credential test endpoint . The root cause is the resolution of project-scoped variables without validating caller access. An attacker can provide an arbitrary project ID in the request body to i...