آخرین آسیب‌پذیری‌ها

ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard

MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads

MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware

SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias

n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy

n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node

n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass

Echo: Decompress permits unbounded gzip expansion in v4

Echo: BodyDump captures request and response bodies without size limits in v4

opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when…

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string