n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the w...

CVE-2026-56775

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run en

来源摘录 · NVD

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attacker...

CVE-2026-56220

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows re

历史摘要 · 未重新核验 · NVD

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release ...

CVE-2026-56086

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 r

历史摘要 · 未重新核验 · NVD

n8n - Authorization Bypass in Public API Execution Retry Endpoint

CVE-2026-56778

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint,

历史摘要 · 未重新核验 · OSV.dev

n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

CVE-2026-56776

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/n

历史摘要 · 未重新核验 · OSV.dev

n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

CVE-2026-56775

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run en

历史摘要 · 未重新核验 · OSV.dev

Capgo - Unauthorized Manifest Insertion via Read-Only Org Member

CVE-2026-56220

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows re

历史摘要 · 未重新核验 · OSV.dev

importModule function in MISP ignores per-organisation import module restrictions

CVE-2026-60125

MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not en

历史摘要 · 未重新核验 · OSV.dev

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates th...

CVE-2026-55428

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · NVD

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

CVE-2026-55428

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · OSV.dev

Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

### Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn ass

历史摘要 · 未重新核验 · GitHub Advisory

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

CVE-2026-53552

### Summary `Project.AddFile`, `Project.EditFile`, `Project.RemoveFile`, and `Project.Edit` in `cmd/server/api/project/

历史摘要 · 未重新核验 · GitHub Advisory

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF s...

CVE-2026-54698

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a

历史摘要 · 未重新核验 · NVD

Hasura: Row-level authorization bypass on table computed fields

CVE-2026-54698

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a

历史摘要 · 未重新核验 · OSV.dev

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRed...

CVE-2026-53935

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 t

历史摘要 · 未重新核验 · NVD

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before valid...

CVE-2026-50529

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share int

历史摘要 · 未重新核验 · NVD

@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators

### Am I affected? Users are affected if all of the following hold: - Their application depends on `@better-auth/oaut

历史摘要 · 未重新核验 · GitHub Advisory

CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

CVE-2026-53935

Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 t

历史摘要 · 未重新核验 · OSV.dev

DataEase: Link Token Leakage Prior to Share Password/Ticket Validation

CVE-2026-50529

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share int

历史摘要 · 未重新核验 · OSV.dev

Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins

CVE-2026-53512

### Am I affected? Users are affected if all of the following are true: - Their application uses `better-auth` and has

历史摘要 · 未重新核验 · GitHub Advisory