•less than a minute ago•CVE-2026-65592
8.4CVE-2026-65592: Stored DOM-based Cross-Site Scripting via cachedResultUrl in n8n
A Stored DOM-based Cross-Site Scripting (XSS) vulnerability exists within the frontend Resource Locator component of n8n. The flaw stems from insecure usage of window.open() where the application evaluates the workflow-persisted parameter 'cachedResultUrl' without verifying its protocol scheme. Authenticated attackers with permissions to create or edit workflows can insert a 'javascript:' URI payload, leading to arbitrary code execution in the victim's browser context upon interaction.
0 views•5 min read
•about 1 hour ago•CVE-2026-65599
5.1CVE-2026-65599: Google Service Account Private Key Leakage via JWT Header Parameter in n8n
A credential exposure vulnerability in n8n (CVE-2026-65599) transmits the complete PEM-formatted Google Service Account private key in the 'kid' (Key ID) parameter of outbound JWT headers during Google API authentication. Because JWT headers are encoded in plain Base64URL and not encrypted, any entity that intercepts, logs, or processes these outbound requests can immediately extract the plaintext private key. This enables unauthorized third parties to fully compromise the corresponding Google Cloud Platform (GCP) service account and access any authorized cloud resources.
0 views•7 min read
•about 4 hours ago•CVE-2026-47300
8.8CVE-2026-47300: Elevation of Privilege in ASP.NET Core Negotiate Authentication Handler
CVE-2026-47300 is a high-severity Elevation of Privilege (EoP) vulnerability in Microsoft's ASP.NET Core framework, affecting the Negotiate Authentication Handler when configured to retrieve security groups and role mappings via an LDAP/Active Directory directory service. In cross-platform Linux and macOS environments where native Windows token group expansion is unavailable, an authenticated attacker with low-privileged network access can manipulate LDAP query structures or force connections to untrusted directory resources, resulting in unauthorized administrative role assignment.
4 views•6 min read
•about 10 hours ago•CVE-2026-20779
7.1CVE-2026-20779: TOTP Single-Use Enforcement Defect in Gitea
Gitea versions from 1.5.0 before 1.26.3 contain a security vulnerability in their multi-factor authentication (MFA) logic. This vulnerability allows valid TOTP codes to be accepted multiple times across web authentication flows and the Basic Auth X-Gitea-OTP header path. Due to a TOCTOU race condition and a lack of state tracking in programmatic auth pathways, attackers with valid credentials can replay single-use OTP codes.
6 views•6 min read
•about 11 hours ago•GHSA-R7WM-3CXJ-WFF9
5.3GHSA-R7WM-3CXJ-WFF9: StreamReadConstraints Bypass in jackson-core Async Parser
A critical validation bypass exists in FasterXML jackson-core due to an incomplete fix for GHSA-72hv-8253-57qq. When parsing JSON asynchronously using NonBlockingUtf8JsonParserBase, the StreamReadConstraints.maxNumberLength constraint is bypassed when numeric inputs are received in small, non-terminating chunks. The parser continually accumulates digit-only input in an internal buffer without triggering validation constraints, resulting in potential heap memory exhaustion and application-level Denial of Service.
9 views•6 min read
•about 12 hours ago•GHSA-2RP8-MM9Q-FP49
8.0GHSA-2RP8-MM9Q-FP49: Remote Code Execution via Template-Literal Code Injection in TypeORM migration:generate
A critical second-order code injection vulnerability exists in the migration generation engine of TypeORM. When TypeORM introspects a database schema to automatically generate migration files, it writes schema metadata directly into JavaScript/TypeScript migration files inside ES2015 template literals. Because the generator failed to sanitize template literal string interpolation markers and backslashes, attackers with control over database metadata can execute arbitrary code on the developer environment or within a CI/CD pipeline.
5 views•5 min read
•about 13 hours ago•GHSA-9WJQ-CP2P-HRGF
4.7GHSA-9WJQ-CP2P-HRGF: SVG href Attribute Bypass in Loofah HTML/XML Sanitizer
A security logic flaw in Loofah, a Ruby HTML/XML sanitization library, allowed unauthenticated attackers to bypass local-reference restrictions on SVG elements. Prior to version 2.25.2, Loofah only sanitized the legacy namespaced "xlink:href" attribute when enforcing local URI fragments on SVG elements like "<use>". It did not validate or sanitize the plain, non-namespaced "href" attribute introduced in the SVG 2 standard. This structural omission allowed attackers to construct SVG elements referencing external domains, paving the way for arbitrary resource loading and cross-site scripting (XSS).
5 views•5 min read
•about 14 hours ago•GHSA-5QHF-9PHG-95M2
8.8GHSA-5QHF-9PHG-95M2: Stored Cross-Site Scripting via Parser Differential in Loofah allowed_uri?
A critical HTML sanitization bypass vulnerability in the Ruby library Loofah allows unauthenticated remote attackers to execute Stored Cross-Site Scripting (XSS) attacks. By using semicolon-less numeric character references (NCRs) to encode protocol characters, attackers can evade backend URI verification filters while ensuring the malicious protocol is successfully decoded and executed by client-side web browsers.
7 views•9 min read
•about 15 hours ago•GHSA-HRXH-6V49-42GF
8.6GHSA-HRXH-6V49-42GF: HTTP/2 Control Buffer Flooding and xDS RBAC Parsing Weaknesses in gRPC-Go
GHSA-HRXH-6V49-42GF is a critical security advisory addressing two distinct vulnerabilities within gRPC-Go: an HTTP/2 Control Buffer Flooding weakness that allows unauthenticated denial of service, and xDS Role-Based Access Control parser weaknesses that lead to authorization bypasses and application panics.
10 views•8 min read
•about 16 hours ago•GHSA-9MQV-5HH9-4CGG
7.5GHSA-9MQV-5HH9-4CGG: Unauthenticated Memory-Leak Denial of Service in @hono/node-server WebSocket Handshake Parser
An unauthenticated memory-leak Denial of Service (DoS) vulnerability exists in the Node.js Adapter for Hono (@hono/node-server) during the WebSocket handshake upgrade process. If a client initiates a WebSocket upgrade but the process is aborted or fails, resources are permanently retained in memory, leading to heap exhaustion.
6 views•6 min read
•about 17 hours ago•GHSA-CJ75-F6XR-R4G7
5.1GHSA-cj75-f6xr-r4g7: Cross-Site Scripting (XSS) Bypass via SVG href Attributes in rails-html-sanitizer
An issue in rails-html-sanitizer allowed attackers to bypass restrictions on SVG reference elements (such as <use> or <feImage>) when specific custom configurations allowed these tags. Because the sanitizer only restricted the legacy 'xlink:href' attribute to local references, modern browsers supporting plain 'href' attributes according to the SVG 2 specification would load external resources. This could lead to Cross-Site Scripting (XSS) or user tracking.
4 views•6 min read
•about 18 hours ago•GHSA-RWJ8-PGH3-R573
10.0GHSA-RWJ8-PGH3-R573: Environment Variable Exfiltration and Protocol Validation Bypass in GitPython
An input validation flaw in GitPython allows remote attackers to exfiltrate system environment variables and bypass safe-protocol restrictions via crafted repository URLs passed to the clone API.
8 views•7 min read