Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept a

历史摘要 · 未重新核验 · GitHub Advisory

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

### Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nod

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

CVE-2026-62323

## Summary Cloudreve WOPI access tokens are generated as `.`, but the WOPI middleware validates only the session id pre

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs

## Impact In Budibase v3.39.4, a regression in the authorization level for the S3 attachment upload endpoint allows any

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Privilege escalation via public role assignment API missing app-level authorization

### Summary Budibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

CVE-2026-59212

## Summary Current `main` and `v0.9.6` still allow an authenticated user to turn read-only access to another user's fil

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

CVE-2026-55502

## Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

CVE-2026-55499

## Summary When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/e

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected

历史摘要 · 未重新核验 · GitHub Advisory

n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction

CVE-2026-65596

## Impact The GraphQL node did not enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (suc

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

CVE-2026-65594

## Impact The OAuth 2.1 consent and token-issuance flow introduced in n8n 2.27.0 does not verify that the authenticated

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced insi

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

## Impact An authenticated member with edit access to a shared workflow could reference another user's credential in an

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

## Impact The credential "Allowed HTTP Request Domains" allowlist was intended to restrict which hosts a credential's s

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

## Impact In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, t

历史摘要 · 未重新核验 · GitHub Advisory

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing q...

CVE-2026-13068

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate ac

历史摘要 · 未重新核验 · NVD

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. T...

CVE-2026-13067

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be v

历史摘要 · 未重新核验 · NVD

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restr...

CVE-2026-13061

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessi

历史摘要 · 未重新核验 · NVD

An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLoo...

CVE-2026-13060

An authenticated user with limited read privileges may be able to access documents from collections they are not authori

历史摘要 · 未重新核验 · NVD

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist...

CVE-2026-65602

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRo

历史摘要 · 未重新核验 · NVD