Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filt...

CVE-2026-65601

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.

历史摘要 · 未重新核验 · NVD

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in...

CVE-2026-65596

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr

来源摘录 · NVD

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user ...

CVE-2026-65594

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was

来源摘录 · NVD

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewe...

CVE-2026-65015

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio

来源摘录 · NVD

Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

CVE-2026-65602

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRo

历史摘要 · 未重新核验 · OSV.dev

Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

CVE-2026-65601

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider.

历史摘要 · 未重新核验 · OSV.dev

n8n before 1.123.64 Credential Exfiltration via GraphQL Node

CVE-2026-65596

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr

历史摘要 · 未重新核验 · OSV.dev

n8n before 2.30.1 Missing OAuth Authorization Check

CVE-2026-65594

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was

历史摘要 · 未重新核验 · OSV.dev

n8n before 2.30.1 Privilege Escalation via run_node_tool

CVE-2026-65015

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-executio

历史摘要 · 未重新核验 · OSV.dev

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning...

CVE-2026-63145

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification

历史摘要 · 未重新核验 · GitHub Advisory

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with...

CVE-2026-63142

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reportin

历史摘要 · 未重新核验 · GitHub Advisory

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrai...

CVE-2026-63145

Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification

历史摘要 · 未重新核验 · NVD

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configu...

CVE-2026-63142

Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reportin

历史摘要 · 未重新核验 · NVD

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily ex...

CVE-2026-61325

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The

历史摘要 · 未重新核验 · NVD

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to...

CVE-2026-43947

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Co

历史摘要 · 未重新核验 · NVD

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated acces...

CVE-2026-43946

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in t

历史摘要 · 未重新核验 · NVD

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execut...

CVE-2026-43945

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthent

历史摘要 · 未重新核验 · NVD

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization eng

历史摘要 · 未重新核验 · GitHub Advisory

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

CVE-2026-59889

## Summary `UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by it

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

CVE-2026-57897

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @

历史摘要 · 未重新核验 · GitHub Advisory