2026

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor priv

ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints.  A low-privileged authenticat

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account con

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when

ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malic

ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functiona

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handlin

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Bayla

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allo

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP

Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery.

Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control S

HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes

Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-

HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability a

HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can

HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to acces

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent r

n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git no

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS)

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. Whe

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability

n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. W

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's protot

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. Wh

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resour

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text oper

n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authent

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completi

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row G

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-t

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-s

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.

Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.

Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.

Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.

Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.

Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.

Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.

Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.