Rezultati pretraživanja za 'Od datuma: 15.12.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-65598 | 7.5 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the cl | 2026-10-29 20:17:33 | 2026-07-22 12:18:20 |
| CVE-2026-62018 | 9.8 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | 2026-10-29 20:17:32 | 2026-10-29 16:18:14 |
| CVE-2026-62013 | 9.8 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | 2026-10-29 20:17:32 | 2026-10-29 16:18:14 |
| CVE-2026-62008 | 9.8 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | 2026-10-29 20:17:32 | 2026-10-29 16:18:13 |
| CVE-2026-65597 | 5.4 | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injec | 2026-10-29 20:17:32 | 2026-07-22 12:18:19 |
| CVE-2026-65596 | 8.1 | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user ab | 2026-10-29 20:17:32 | 2026-07-22 12:18:19 |
| CVE-2026-65595 | 8.8 | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who | 2026-10-29 20:17:32 | 2026-07-22 12:18:19 |
| CVE-2026-65594 | 6.5 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances | 2026-10-29 20:17:32 | 2026-07-22 12:18:19 |
| CVE-2026-65593 | 5.4 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to | 2026-10-29 20:17:32 | 2026-07-22 12:18:19 |
| CVE-2026-51832 | - | An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component | 2026-10-29 20:17:31 | 2026-10-29 20:17:31 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12597
Zapisa po stranici: