#CVE

共收录 63078 条相关情报。

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node pa...

CVE-2026-118676

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use c

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-863

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-wor...

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared w

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布HIGH

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto...

CVE-2026-118649

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner projec

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error response...

CVE-2026-118648

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability be

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw requ...

CVE-2026-118647

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error ex

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-532

漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob ...

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authen

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base...

CVE-2026-118645

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-28 发布HIGH

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error wor...

CVE-2026-118644

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of

来源摘录 · NVD

#cve #cwe-266

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, a...

CVE-2026-118643

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-209

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workf...

CVE-2026-118642

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoi...

CVE-2026-118641

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in th

来源摘录 · NVD

#cve #cwe-943

漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the ...

CVE-2026-118640

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-10-28 发布HIGH

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaini...

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM

来源摘录 · NVD

#cve #cwe-35

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead ...

CVE-2026-118265

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-sup

来源摘录 · NVD

#cve #cwe-348

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the con...

CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a clien

来源摘录 · NVD

#cve #cwe-444 #cwe-863

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture li...

CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-252

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client d...

CVE-2026-118262

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy gorou

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-772

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small com...

CVE-2026-118261

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded reque

来源摘录 · NVD

#cve #cwe-400 #cwe-409

漏洞预警2026-10-28 发布INFO

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete resp...

CVE-2026-118260

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies

来源摘录 · NVD

#cve #cwe-400 #cwe-770

漏洞预警2026-10-28 发布MEDIUM

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceCont...

CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing tel

来源摘录 · NVD

#cve #cwe-1333