n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint
CVE-2026-56776
n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/n
2026-07-09 归档
今日共收录 1410 条安全情报，包含 455 个 CVE，561 篇安全通告，以及 105 篇研究论文。
← 返回归档列表Wazuh - NULL Pointer Dereference in inventory_sync DataValue FlatBuffer Handling
CVE-2026-56401
Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventory_sync FlatBuffer D
ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter
CVE-2026-56374
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the FTXT encoder due to missing boundary ch
ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization
CVE-2026-56362
ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixelIndex caused by OpenPixelCache
n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
CVE-2026-56360
n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger
Capgo - EXIF Metadata Exposure in App Information Image Upload
CVE-2026-56298
Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensi
FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback
CVE-2026-56297
FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to
Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app()
CVE-2026-56293
Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org whe
Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC
CVE-2026-56284
Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC func
Capgo - HTML Injection Leading to Open Redirection in Organization Settings
CVE-2026-56283
Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attacke
Flowise - Path Traversal in Vector Store basePath Parameter
CVE-2026-56273
Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that
Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions
CVE-2026-56250
Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST,
Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance
CVE-2026-56246
Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped A
Capgo - Unauthenticated Organization Data Disclosure via get_orgs_v6 RPC
CVE-2026-56226
Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which
Capgo - Unauthorized Manifest Insertion via Read-Only Org Member
CVE-2026-56220
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows re
Capgo - Encrypted Bundle Policy Bypass via Direct PostgREST Update
CVE-2026-56217
Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped A
importModule function in MISP ignores per-organisation import module restrictions
CVE-2026-60125
MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not en
MISP importModule missing authorization allows read-only users to modify events via misp_standard imports
CVE-2026-60124
An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys wit
flask-dashboard Flask-MonitoringDashboard cross-site request forgery
CVE-2026-15034
A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some
Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query
CVE-2026-44840
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in