Permalink CVE-2026-53938

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): High (H)

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)

• https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj x_refsource_CONFIRM
• https://github.com/OpenIDC/cjose/commit/8c51d245273583a658f24ef7b08ba22f848a34a5 x_refsource_MISC

---

cjose

• ==< 0.6.2.5

Permalink CVE-2026-86515

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored package deadbeefPlugins.vgmstream 2 hours ago
• @LeSuisse ignored reference https://g… 2 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

vgmstream txtp txtp_parser.c add_entry resource consumption

• VDB-399669 | vgmstream txtp txtp_parser.c add_entry resource consumption technical-descriptionvdb-entry
• VDB-399669 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-requiredsignature
• CVE-2026-86515 | CVE Analysis and Report third-party-advisory
• Submit #908370 | vgmstream r2117 Resource Consumption third-party-advisory
• https://github.com/vgmstream/vgmstream/issues/1973 issue-trackingexploit
• https://github.com/vgmstream/vgmstream/pull/1965 issue-trackingpatch
• https://github.com/vgmstream/vgmstream/commit/4b6a02dd1aff6428255db912563d77d4c… patch

Ignored references (1)

• https://github.com/vgmstream/vgmstream/ product

---

vgmstream

• ==r2117

Permalink CVE-2026-86514

2.1 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Exploit Maturity (E): POC (P)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored package deadbeefPlugins.vgmstream 2 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

vgmstream txth-txtp txth.c sscanf stack-based overflow

• VDB-399668 | vgmstream txth-txtp txth.c sscanf stack-based overflow technical-descriptionvdb-entry
• VDB-399668 | CTI Indicators (IOB, IOC, IOA) permissions-requiredsignature
• CVE-2026-86514 | CVE Analysis and Report third-party-advisory
• Submit #908369 | vgmstream r2117 Stack-based Buffer Overflow third-party-advisory
• https://github.com/vgmstream/vgmstream/issues/1972 issue-trackingexploit
• https://github.com/vgmstream/vgmstream/pull/1956 issue-trackingpatch
• https://github.com/vgmstream/vgmstream/commit/4669d37a6af94866f6f0628678f9f90d4… patch
• https://github.com/vgmstream/vgmstream/ product

---

vgmstream

• ==r2117

Permalink CVE-2026-53939

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption

• https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq x_refsource_CONFIRM
• https://github.com/OpenIDC/cjose/commit/2a6e5bd969fa20059fb00913fb9f57d77ea6a4d9 x_refsource_MISC
• https://github.com/OpenIDC/cjose/releases/tag/v0.6.2.6 x_refsource_MISC

---

cjose

• ==>= 0.6.1, < 0.6.2.6

Permalink CVE-2026-85485

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 2 hours ago

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping

• https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes release-notes
• https://github.com/gshank/html-formhandler/commit/2ea9e138dbfe231e317c13936abe6… patch

---

HTML-FormHandler

• <0.410002

Permalink CVE-2026-85630

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method

• https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes release-notes
• https://github.com/gshank/html-formhandler/commit/a887271e91d755e6486a9f433ae93… patch
• http://www.openwall.com/lists/oss-security/2026/09/08/18

---

HTML-FormHandler

• <0.410002

Permalink CVE-2026-19872

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message

• https://github.com/gshank/html-formhandler/commit/2574fdb4561f5c32d44cfbfbb3188… patch
• https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410000/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/09/08/15

---

HTML-FormHandler

• <0.410000

Permalink CVE-2026-85484

updated 2 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse accepted 2 hours ago
• @LeSuisse published on GitHub 2 hours ago

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping

• https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410002/changes release-notes
• https://github.com/gshank/html-formhandler/commit/49b562e0fed5146fc1a372c5fa8a8… patch
• http://www.openwall.com/lists/oss-security/2026/09/08/16

---

HTML-FormHandler

• <0.410002

Permalink CVE-2026-86074

5.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

• https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86082

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

• https://github.com/n8n-io/n8n/security/advisories/GHSA-34ff-336r-5q23 x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86993

5.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

• https://github.com/n8n-io/n8n/security/advisories/GHSA-pq6c-vh67-xpm3 x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86083

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution

• https://github.com/n8n-io/n8n/security/advisories/GHSA-6xcw-7xm6-48c6 x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86084

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

• https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37 x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86081

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

• https://github.com/n8n-io/n8n/security/advisories/GHSA-j535-v25q-vx3q x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86085

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

• https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86995

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

• https://github.com/n8n-io/n8n/security/advisories/GHSA-qgpw-8g46-w95v x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86994

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

• https://github.com/n8n-io/n8n/security/advisories/GHSA-65xw-2v52-jhxc x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86076

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored maintainer @wrbbz 3 hours ago maintainer.ignore
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

• https://github.com/n8n-io/n8n/security/advisories/GHSA-hw8v-xxg5-vvvx x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86078

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

• https://github.com/n8n-io/n8n/security/advisories/GHSA-679f-58pq-4v2c x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86079

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

• https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cp-m7mv-8jpv x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86080

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 12 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

• https://github.com/n8n-io/n8n/security/advisories/GHSA-5m98-cgcr-xx3q x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 1.123.76
• ==>= 2.0.0, < 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86075

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

• https://github.com/n8n-io/n8n/security/advisories/GHSA-hh89-3r9w-qj3j x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86996

5.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

• https://github.com/n8n-io/n8n/security/advisories/GHSA-7hgx-277f-7vmg x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86073

5.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

• https://github.com/n8n-io/n8n/security/advisories/GHSA-cw9w-vv67-hf73 x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/pull/37122 x_refsource_MISC
• https://github.com/n8n-io/n8n/pull/37588 x_refsource_MISC
• https://github.com/n8n-io/n8n/commit/18458482861097a26f874f30ad7e8136e268475c x_refsource_MISC
• https://github.com/n8n-io/n8n/commit/380788fd9a3264c83161e868026a98731d274d88 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.1 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.1

Permalink CVE-2026-86077

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): Low (L)
• Subsequent System Impact Integrity (SI): Low (L)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Low (L)
• Modified Subsequent System Impact Integrity (MSI): Low (L)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 3 hours ago by @LeSuisse Activity log

• Created suggestion 11 hours ago
• @LeSuisse ignored
  3 packages

  • n8n-nodes-carbonejs
  • n8n-nodes-evolution-api
  • n8n-task-runner-launcher
  3 hours ago
• @LeSuisse accepted 3 hours ago
• @LeSuisse published on GitHub 3 hours ago

n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

• https://github.com/n8n-io/n8n/security/advisories/GHSA-35jj-42hp-8gmq x_refsource_CONFIRM
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 x_refsource_MISC
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 x_refsource_MISC

---

n8n

• ==< 2.37.7
• ==>= 2.38.0, < 2.38.2

Permalink CVE-2026-86506

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 23 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 23 hours ago
• @LeSuisse published on GitHub 23 hours ago

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

GoLand

• <2026.2.2.1

Permalink CVE-2026-16028

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.13/source/lib/Protocol/HTTP2…
• https://github.com/vlet/p5-Protocol-HTTP2/commit/27a488a34d74fd16f123e5e6186d4f… patch
• https://metacpan.org/release/CRUX/Protocol-HTTP2-1.14/changes release-notes
• http://www.openwall.com/lists/oss-security/2026/09/07/2

---

Protocol-HTTP2

• <1.14

Permalink CVE-2026-75046

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 1 day ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18112

Permalink CVE-2026-75045

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 1 day ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2025.3.156085, 2026.1.13913, 2026.2.18112

Permalink CVE-2026-86493

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-75048

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 1 day ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18068

Permalink CVE-2026-75044

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 3 weeks, 1 day ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2025.3.156085, 2026.1.13914, 2026.2.18095

Permalink CVE-2026-86488

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86484

4.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86495

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18687

Permalink CVE-2026-86487

3.1 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86479

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18788, 2026.1.14055, 2025.3.161254

Permalink CVE-2026-86491

3.5 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86486

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86483

5.4 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86496

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18769

Permalink CVE-2026-86490

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86482

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86497

6.8 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18769

Permalink CVE-2026-86485

3.3 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86481

4.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86492

8.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86494

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-86489

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user …

• https://www.jetbrains.com/privacy-security/issues-fixed/

---

YouTrack

• <2026.2.18634

Permalink CVE-2026-84256

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse ignored
  7 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  • gnomeExtensions.openvpn3-indicator
  1 day, 9 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-84256 vendor-advisory

---

OpenVPN

• =<2.6.22
• =<2.7.6

Permalink CVE-2026-84226

8.5 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse ignored
  7 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  • gnomeExtensions.openvpn3-indicator
  1 day, 9 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-84226 vendor-advisory

---

OpenVPN

• =<2.6.22
• =<2.7.6

Permalink CVE-2026-84732

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Low (L)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 9 hours ago by @LeSuisse Activity log

• Created suggestion 1 day, 12 hours ago
• @LeSuisse ignored
  7 packages

  • openvpn3
  • openvpn-auth-ldap
  • namespaced-openvpn
  • openvpn_learnaddress
  • networkmanager-openvpn
  • nagiosPlugins.check_openvpn
  • gnomeExtensions.openvpn3-indicator
  1 day, 9 hours ago
• @LeSuisse accepted 1 day, 9 hours ago
• @LeSuisse published on GitHub 1 day, 9 hours ago

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and …

• https://community.openvpn.net/Security%20Announcements/CVE-2026-84732 vendor-advisory

---

OpenVPN

• =<2.6.22
• =<2.7.6