Archive
22 July 2026
Vulnerabilities first published on this day (UTC), newest first.
201 results · Feed
-
Medium 5.1
n8n before 2.30.1 Missing OAuth Authorization Check
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at …
-
High 8.4
n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with work…
-
Medium 5.5
n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network rest…
-
High 8.9CVE-2026-65591 Public exploit
n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code e…
-
Medium 5.1
n8n before 1.123.64 Credential Exposure via LLM Node Execution Data
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header v…
-
High 7.7
n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the glob…
-
High 7.2
n8n before 2.30.1 Privilege Escalation via run_node_tool
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabl…
-
Medium 6.3
n8n before 2.28.0 Authentication Bypass via test-webhook
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow…
-
Medium 6.5
Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events…
-
Medium 5.3
There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain…
-
High 7.2
There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers…
-
High 7.7
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to c…
-
High 7.5
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers …
-
Medium 6.6
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the …
-
Medium 4.3
Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame
A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap out-of-bounds read. This could allow an adjacent attacker streaming Bluetooth audio to read a single …
-
High 8.8
Local Privilege Escalation in servereye client (sensorhub)
The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodi…
-
Medium 6.5CVE-2026-2406 Public exploit
IDOR in Universe Software's Online Registration and Workflow Management System
Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Wor…
-
Medium 6.4
Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, and including, 2.9.1 due to insufficient input sanitization and o…
-
Medium 5.3
Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3
Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
-
Critical 9.4
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
-
High 7.5
Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1
Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice informatio…
-
Medium 6.6
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 cause…
-
High 8.8
Supermicro SMASH service contain an Arbitrary code execution issue
Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.
-
High 7.5
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed cl…
-
High 8.8
Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload
The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malici…
-
Medium 5.3
Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointme…
-
High 8.1
WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticate…
-
Medium 5.5
umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection
A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit h…
-
High 8.4
A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate…
-
Medium 6.3
itsourcecode Hospital Management System prescription.php sql injection
A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The explo…
-
High 8.8
An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execut…
-
Critical 9.8
An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and exe…
-
Medium 5.4
BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to byp…
-
High 8.8
An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneComma…
-
High 8.8
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arb…
-
High 7.8
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.
-
High 8.8
An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafte…
-
High 8.8
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a c…
-
High 7.8CVE-2026-38765 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kern…
-
High 7.8CVE-2026-38766 Public exploit
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_…