n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
CVE-2026-103254
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi
2026-10-02 归档
今日共收录 1399 条安全情报，包含 504 个 CVE，518 篇安全通告，以及 100 篇研究论文。
← 返回归档列表n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
CVE-2026-103253
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerabi
n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
CVE-2026-103252
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vu
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
CVE-2026-103251
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulner
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
CVE-2026-103250
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerab
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site sc
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
CVE-2026-103248
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnera
n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
CVE-2026-103247
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow c
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool
n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
CVE-2026-103245
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signa
ground-station before 0.8.0 Authentication Bypass via setup.restore
CVE-2026-103244
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that al
Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances
CVE-2026-103431
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote c
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
CVE-2026-15983
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in al
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up
datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
CVE-2026-103544
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown
formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
CVE-2026-103542
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/c
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
CVE-2026-88999
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5
formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
CVE-2026-103541
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
CVE-2026-103540
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct
BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
CVE-2026-101887
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a