Graylog2 Server Missing Permission Check on Event Definition Duplicate
CVE-2026-65011
Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{de
#advisory
共收录 23779 条相关情报。
← 返回所有主题libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow
CVE-2026-48029
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in Image
ReDoS in Open Mercato
CVE-2026-16270
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex
Denial-of-Service in OpenCanary's MongoDB module
CVE-2026-16551
Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affe
Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass
CVE-2026-65602
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRo
Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef
CVE-2026-65601
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.
Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
CVE-2026-65600
Traefik versions = v3.6.0 = v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex
n8n before 1.123.64 Credential Exposure via JWT Header
CVE-2026-65599
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo
n8n before 1.123.64 Remote Code Execution via Git Clone
CVE-2026-65598
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows a
n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
CVE-2026-65597
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the
n8n before 1.123.64 Credential Exfiltration via GraphQL Node
CVE-2026-65596
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr
n8n before 2.30.1 Privilege Escalation via Token Exchange
CVE-2026-65595
n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardle
n8n before 2.30.1 Missing OAuth Authorization Check
CVE-2026-65594
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was
n8n before 1.123.64 SSRF via Dynamic Node Parameters
CVE-2026-65593
n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoint
n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
CVE-2026-65592
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
CVE-2026-65591
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authentic
n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
CVE-2026-65590
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/
n8n before 1.123.64 Credential Exposure via LLM Node Execution Data
CVE-2026-65589
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writin
n8n before 1.123.64 Privilege Escalation via SSO Instance-Role
CVE-2026-65016
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance
n8n before 2.30.1 Privilege Escalation via run_node_tool
CVE-2026-65015
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio