Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.3Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race ConditionOct 14, 2026
- Medium6.9GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()Oct 14, 2026
- High8.7GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NameOct 14, 2026
- Critical9.2GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() RefspecOct 14, 2026
- High7.7GitPython before 3.2.0 Command Execution via ls_remote ext:: URLsOct 14, 2026
- High8.7GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_dateOct 14, 2026
- High7.1GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule NameOct 14, 2026
- High8.2Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit.Oct 14, 2026
- High7.1n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSONOct 14, 2026
- Medium6.3n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook ResolutionOct 14, 2026
- Medium6.1n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create EndpointOct 14, 2026
- High7.2n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node ParametersOct 14, 2026
- High7.2n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File PreviewOct 14, 2026
- Medium6.0n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection MergeOct 14, 2026
- High7.0n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss ParameterOct 14, 2026
- High7.0n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-WebhookOct 14, 2026
- High7.7n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log OperationOct 14, 2026
- High7.2n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-WorkflowsOct 14, 2026
- High8.2n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize EndpointOct 14, 2026
- Medium6.3qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringOct 14, 2026
- High7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.Oct 14, 2026
- Medium5.3A security vulnerability has been detected in Praat up to 7.0.02.Oct 14, 2026
- High7.4An administrator could retrieve the password reset code for any user and take over the account.Oct 14, 2026
- Critical9.1When the default self-signed certificate is used, an attacker could gain administrative access to the application.Oct 14, 2026
- Critical9.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.Oct 14, 2026