n8n before 2.30.1 Privilege Escalation via run_node_tool
CVE-2026-65015
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio
2026-07-23 归档
今日共收录 1422 条安全情报，包含 546 个 CVE，469 篇安全通告，以及 113 篇研究论文。
← 返回归档列表n8n before 2.28.0 Authentication Bypass via test-webhook
CVE-2026-65014
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoi
CVE-2026-45820
CVE-2026-45820
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with
umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
CVE-2026-16492
A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of
jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
CVE-2026-16489
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
CVE-2026-56820
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
CVE-2026-56817
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
CVE-2026-56816
Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's
Netty has a Security Control Bypass via CORS Short-Circuit Failure
CVE-2026-56746
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4
Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
CVE-2026-56745
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow
CVE-2026-10680
The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/class
Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS)
CVE-2026-10679
The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config-
NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller
CVE-2026-10678
The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writ
Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool
CVE-2026-10677
The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied
Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS)
CVE-2026-10675
In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the
DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled
CVE-2026-10674
The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, cal
FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
CVE-2026-43946
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in t
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
CVE-2026-43945
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthent
Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
CVE-2026-55851
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to
libheif Has Heap Buffer Overflow in `Track::get_next_sample_raw_data()` -- OOB Chunk Vector Access
CVE-2026-47254
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, `Track::init_sample_timing_table()`