CVE-2026-103251 is a high-severity vulnerability in n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. It involves a validation bypass in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass multiple security checks to install arbitrary npm packages across all cluster instances without authentication.
A NoSQL injection vulnerability exists in n8n's MongoDB Chat Memory node due to improper validation of the sessionId parameter. This affects n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1. Unauthenticated attackers can exploit this flaw to access other users' conversation histories and perform unauthorized write and delete operations.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.
n8n versions before 1.123.80 have a credential tampering vulnerability that allows attackers with editor access to shared workflows to bypass the workflow credential tamper guard. This is achieved through duplicate node IDs causing mismatched node ID and name matching, enabling retention of victim credentials and redirection of secrets to attacker-controlled hosts.
CVE-2026-103246 is a high-severity authorization bypass vulnerability in n8n versions before 2.39.6 and versions 2.40.0 before 2.40.1. The flaw allows attackers to bypass credential ownership validation during inline agent node-tool introspection, enabling them to reference arbitrary credential IDs. This can lead to decryption and exfiltration of plaintext secrets to attacker-controlled hosts without verifying ownership.
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and manipulate downstream actions like record creation or API calls.
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
CVE-2026-103082 is a Server-Side Request Forgery (SSRF) vulnerability in LA-Studio Element Kit for Elementor. It affects versions from the initial release up to 1.6.2 inclusive. The vulnerability allows an attacker to induce the server to make HTTP requests to arbitrary domains, potentially leading to information disclosure and integrity impact. The CVSS v3.1 base score is 7.2, indicating a high severity issue. No official patch or remediation details are provided in the available data.
This analysis discusses practical defensive strategies to frustrate cyber adversaries at various stages of their operations. Techniques such as deception (honeypot accounts, false infrastructure, tarpits), behavioral detections, tighter control of legitimate remote-management tools, and clear boundaries around AI agents can slow attackers and increase detection opportunities. By breaking dependencies between attack stages and reducing adversary choices, defenders can force attackers into slower, less stealthy, and more costly alternatives. The approach emphasizes early disruption of attacks and leveraging unique organizational configurations to reduce common attack success. Behavioral detection focuses on identifying adversary objectives rather than specific tools, increasing resilience against tool substitution. Controlling legitimate tools that adversaries misuse, like remote monitoring software, further limits attacker options. These methods collectively increase the difficulty and risk for attackers, potentially causing them to abandon operations or reveal themselves earlier.
CVE-2026-7176 is a cross-site scripting (XSS) vulnerability in Crocantickets Entradium affecting the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint. This flaw allows injection of JavaScript code that executes on the public ticket purchase page for an event. The vulnerability arises during the creation or modification of forms related to ticket sales. The CVSS 4.0 score is 4.8, indicating a medium severity issue. No affected versions or patch information are provided.
CVE-2026-7175 is a cross-site scripting (XSS) vulnerability in the Crocantickets Entradium product. It affects the Business Name parameter in the /promoters/edit endpoint within the My Profile section of a promoter's profile. This flaw allows injection of JavaScript code that executes on the promoter's public page. The vulnerability has a CVSS 4.8 score, indicating medium severity. No affected versions or patch information are provided.
CVE-2026-7174 is a stored cross-site scripting (XSS) vulnerability in Crocantickets Entradium. It affects the Name and Field parameters of the /tools/discount_wizard/discount_config endpoint used during discount creation for events. This flaw allows injection of malicious JavaScript code that executes when the event's discount list page is viewed. Exploitation requires a user to visit a crafted URL, potentially leading to session data theft.
CVE-2026-7173 is a medium severity cross-site scripting (XSS) vulnerability in Crocantickets Entradium. It involves improper neutralization of input in the City and Description parameters during event creation or editing. The City parameter is vulnerable to stored XSS, allowing JavaScript injection that executes on the event's public page. The Description parameter is vulnerable to reflected XSS when required fields are not filled. Exploitation could allow remote attackers to steal session data via specially crafted URLs.
In October 2025, hackers breached the Pentagon's Defense Manpower Data Center (DMDC) human resources management system, stealing sensitive personnel records of over 3 million individuals. The breach exposed personally identifiable information (PII) including Social Security numbers, names, dates of birth, contact details, sex, race, and military personnel data. The unauthorized access persisted until July 2026. The DMDC responded by initiating incident response actions and is offering affected individuals 12 months of free credit monitoring. This breach impacts both living and deceased military personnel records.
Truffle Security discovered over 500,000 active credentials exposed in public GitHub repositories, with many remaining active years after exposure. Despite GitHub's push protections and secret scanning programs, a large number of credentials remain active because providers do not always revoke leaked tokens. The exposed credentials include Google Cloud service account keys, MongoDB connection strings, and Google API keys. Nearly half of these credentials were pushed after GitHub enabled default push protections, highlighting that prevention alone does not eliminate risk without proper secret revocation.
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns WordPress plugin versions up to 6.4.5 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of the Google Map block's 'marker' attribute, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when any user views the affected page, potentially compromising user data or session integrity.
This advisory addresses security vulnerabilities in GVFS, the GNOME Virtual File System, affecting Red Hat Enterprise Linux 9. The update fixes a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. These issues could allow local attackers to gain elevated privileges or cause memory corruption. The update is rated as important by Red Hat and applies to multiple architectures and variants of Red Hat Enterprise Linux 9.
CVE-2026-96577 is a vulnerability in the oc-mirror component of Red Hat OpenShift Container Platform 4.18. The embedded local cache registry improperly binds to all network interfaces without authentication or encryption during mirroring operations. This misconfiguration allows an unauthenticated attacker on an adjacent network to connect to the service and potentially push tampered container images, delete cached images, or access mirrored content.