n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
CVE-2026-103252
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vu
#cwe-639
共收录 1905 条相关情报。
← 返回所有主题n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
CVE-2026-103247
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow c
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
CVE-2026-103246
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
CVE-2026-64948
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including,...
CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, all...
CVE-2026-96173
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' ...
CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package b...
CVE-2026-102139
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establ
Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, b...
CVE-2026-102107
Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module...
CVE-2026-103054
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file appli...
CVE-2026-102844
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vu
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. At...
CVE-2026-103054
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers ...
CVE-2026-102876
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credent
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check ...
CVE-2026-90907
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8,
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and del...
CVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpA
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Med...
CVE-2026-102261
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/ca
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their...
CVE-2026-97685
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an author
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the...
CVE-2026-102373
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in t