n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
CVE-2026-103251
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulner
#advisory
共收录 23212 条相关情报。
← 返回所有主题n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
CVE-2026-103250
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerab
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
CVE-2026-103249
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site sc
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
CVE-2026-103248
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnera
n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
CVE-2026-103247
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow c
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool
n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
CVE-2026-103245
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signa
ground-station before 0.8.0 Authentication Bypass via setup.restore
CVE-2026-103244
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that al
Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances
CVE-2026-103431
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote c
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
CVE-2026-15983
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in al
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
CVE-2026-15989
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up
datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session
CVE-2026-103544
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown
formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
CVE-2026-103542
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/c
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
CVE-2026-88999
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5
formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload
CVE-2026-103541
A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile
formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine
CVE-2026-103540
A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the funct
David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
CVE-2026-103533
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty
BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS
CVE-2026-101887
BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a
immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
CVE-2026-103532
A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the
decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
CVE-2026-103530
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src