Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
803 results · page 11 of 17
Oct 21, 2025Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).CVE-2025-53052 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Oracle Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55691 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55690 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55689 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55688 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55686 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55685 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55684 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-55682 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-55337 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-55332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-55331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.CVE-2025-55330 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2025-62157 · Other software · argoproj · reported by GitHubHigh 8.5
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissions to read pod logs in a namespace running Argo Workflows can read the workflow-controller logs and obtain credentials to the artifact repository. Update to versions 3.6.12 or 3.7.3 to remediate the vulnerability. No known workarounds exist.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.CVE-2025-62156 · Other software · argoproj · reported by GitHubHigh 8.1
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic (workflow/executor/executor.go) uses filepath.Join(dest, filepath.Clean(header.Name)) without validating that header.Name stays within the intended extraction directory. A malicious archive entry can supply a traversal or absolute path that, after cleaning, overrides the destination directory and causes files to be written outside the /work/tmp extraction path and into system directories such as /etc inside the container. The vulnerability enables arbitrary file creation or overwrite in system configuration locations (for example /etc/passwd, /etc/hosts, /etc/crontab), which can lead to privilege escalation or persistence within the affected container. Update to 3.6.12 or 3.7.3 to remediate the issue.
- Product
- argo-workflows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, CVE-2025-62239 · Other software · Liferay · reported by security@liferay.comMedium 4.6
Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflowCVE-2025-55795 · Other software · Openml · reported by MITRELow 3.5
The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data.
- Product
- Openml Frontend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2025Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc.CVE-2025-8532 · Other software · Bimser Solution Software Trade Inc. · reported by iletisim@usom.gov.trMedium 6.4
Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.
- Product
- eBA Document and Workflow Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 15, 2025n8n is an open source workflow automation platform.CVE-2025-58177 · Other software · n8n-io · reported by GitHubMedium 5.4
n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits the resulting public chat URL. This can be used for phishing or to steal cookies or other sensitive data from users accessing the public chat link. The issue is fixed in version 1.107.0. Updating to 1.107.0 or later is recommended. As a workaround, the affected chatTrigger node can be disabled. No other workarounds are known.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2025Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 - CVE-2024-13065 · Other software · Akinsoft · reported by iletisim@usom.gov.trMedium 6.3
Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 - Flooding. This issue affects MyRezzta: from s2.02.02 before v2.05.01.
- Product
- MyRezzta
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow.CVE-2025-34161 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.7 are vulnerable to a remote code execution vulnerability in the project deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary shell commands via the Git Repository field during project creation. By submitting a crafted repository string containing command injection syntax, an attacker can execute arbitrary commands on the underlying host system, resulting in full server compromise.
- Product
- Coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow.CVE-2025-34159 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a remote code execution vulnerability in the application deployment workflow. The platform allows authenticated users, with low-level member privileges, to inject arbitrary Docker Compose directives during project creation. By crafting a malicious service definition that mounts the host root filesystem, an attacker can gain full root access to the underlying server.
- Product
- Coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2025Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow.CVE-2025-34157 · Other software · coolLabs Technologies · reported by VulnCheckCritical 9.4
Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a maliciously crafted name containing embedded JavaScript. When an administrator attempts to delete the project or its associated resource, the payload executes in the admin’s browser context. This results in full compromise of the Coolify instance, including theft of API tokens, session cookies, and access to WebSocket-based terminal sessions on managed servers.
- Product
- Coolify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2025n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.pyCVE-2025-55526 · Other software · Zie619 · reported by MITRECritical 9.1
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function within api_server.py
- Product
- N8n Workflow Collection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025Langflow is a tool for building and deploying AI-powered agents and workflows.CVE-2025-57760 · Other software · langflow-ai · reported by GitHubHigh 8.8
Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. A patched version has not been made public at this time.
- Product
- langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025n8n is a workflow automation platform.CVE-2025-57749 · Other software · n8n-io · reported by GitHubMedium 6.5
n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node attempts to restrict access to sensitive directories and files, it does not properly account for symbolic links (symlinks). An attacker with the ability to create symlinks—such as by using the Execute Command node—could exploit this to bypass the intended directory restrictions and read from or write to otherwise inaccessible paths. Users of n8n.cloud are not impacted. Affected users should update to version 1.106.0 or later.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism.CVE-2025-50503 · Other software · reported by MITREHigh 8.8
A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide a legitimate authentication factor, such as an OTP. This compromises account security and allows for potential unauthorized access to user data.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtouch.com.lb
Aug 19, 2025Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms pageCVE-2025-8450 · Other software · Fortra · reported by df4dee71-de3a-4139-9588-11b62fe6c0ffHigh 8.2
Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.
- Product
- FileCatalyst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025n8n is a workflow automation platform.CVE-2025-52478 · Other software · n8n-io · reported by GitHubHigh 8.7
n8n is a workflow automation platform. From 1.77.0 to before 1.98.2, a stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using <video> coupled <source> using an onerror event. While using iframe or a combination of video and source tag, this vulnerability allows for Account Takeover (ATO) by exfiltrating n8n-browserId and session cookies from authenticated users who visit a maliciously crafted form. Using these tokens and cookies, an attacker can impersonate the victim and change account details such as email addresses, enabling full control over the account—especially if 2FA is not enabled. Users should upgrade to version >= 1.98.2.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-53133 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow.CVE-2012-10033 · Other software · Ångström Distribution Project · reported by VulnCheckCritical 9.3
Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing attackers to inject arbitrary system commands. Exploitation occurs via a crafted POST request, resulting in command execution under the web server’s context.
- Product
- Narcissus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comweb.archive.org
Jul 26, 2025tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events.CVE-2025-54416 · Other software · tj-actions · reported by GitHubCritical 9.1
tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0
- Product
- branch-names
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025n8n is a workflow automation platform.CVE-2025-52554 · Other software · n8n-io · reported by GitHubMedium 4.9
n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. This issue has been patched in version 1.99.1. A workaround involves restricting access to the /rest/executions/:id/stop endpoint via reverse proxy or API gateway.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025n8n is a workflow automation platform.CVE-2025-49595 · Other software · n8n-io · reported by GitHubMedium 4.9
n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty filesystem URIs (filesystem:// or filesystem-v2://). This allows authenticated attackers to cause service unavailability through malformed filesystem URI requests, effecting the /rest/binary-data endpoint and n8n.cloud instances (confirmed HTTP/2 524 timeout responses). Attackers can exploit this by sending GET requests with empty filesystem URIs (filesystem:// or filesystem-v2://) to the /rest/binary-data endpoint, causing resource exhaustion and service disruption. This issue has been patched in version 1.99.0.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025n8n is a workflow automation platform.CVE-2025-49592 · Other software · n8n-io · reported by GitHubMedium 4.6
n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may lead to phishing attacks by impersonating the n8n UI on lookalike domains (e.g., n8n.local.evil.com), credential or 2FA theft if users are tricked into re-entering sensitive information, and/or reputation risk due to the visual similarity between attacker-controlled domains and trusted ones. The vulnerability affects anyone hosting n8n and exposing the `/signin` endpoint to users. The issue has been patched in version 1.98.0. All users should upgrade to this version or later. The fix introduces strict origin validation for redirect URLs, ensuring only same-origin or relative paths are allowed after login.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents.CVE-2025-49131 · Other software · labring · reported by GitHubMedium 6.3
FastGPT is an open-source project that provides a platform for building, deploying, and operating AI-driven workflows and conversational agents. The Sandbox container (fastgpt-sandbox) is a specialized, isolated environment used by FastGPT to safely execute user-submitted or dynamically generated code in isolation. The sandbox before version 4.9.11 has insufficient isolation and inadequate restrictions on code execution by allowing overly permissive syscalls, which allows attackers to escape the intended sandbox boundaries. Attackers could exploit this to read and overwrite arbitrary files and bypass Python module import restrictions. This is patched in version 4.9.11 by restricting the allowed system calls to a safer subset and additional descriptive error messaging.
- Product
- FastGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2025Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block.CVE-2025-49619 · Other software · Skyvern · reported by MITREHigh 8.5
Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).
- Product
- Skyvern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcristibtz.github.iogithub.com
May 14, 2025Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows.CVE-2025-47775 · Other software · bullfrogsec · reported by GitHubMedium 6.2
Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.
- Product
- bullfrog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2025IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.CVE-2025-1495 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.
- Product
- IBM Business Automation Workflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025n8n is a workflow automation platform.CVE-2025-46343 · Other software · n8n-io · reported by GitHubMedium 5
n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n8n workflows can store and serve binary files, which are accessible to authenticated users. However, there is no restriction on the MIME type of uploaded files, and the MIME type could be controlled via a GET parameter. This allows the server to respond with any MIME type, potentially enabling malicious content to be interpreted and executed by the browser. An authenticated attacker with member-level permissions could exploit this by uploading a crafted HTML file containing malicious JavaScript. When another user visits the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user’s session. This script could send a request to change the user’s email address in their account settings, effectively enabling account takeover. This issue has been patched in version 1.90.0.
- Product
- n8n
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Argo Events is an event-driven workflow automation framework for Kubernetes.CVE-2025-32445 · Other software · argoproj · reported by GitHubCritical 9.9
Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod. With these, a user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template. This vulnerability is fixed in v1.9.6.
- Product
- argo-events
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows.CVE-2025-31494 · Other software · Significant-Gravitas · reported by GitHubLow 3.5
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph_id+graph_version. Additionally, there was no check prohibiting users from subscribing with another user's graph_id+graph_version. As a result, node execution updates from one user's graph execution could be received by another user within the same instance. This vulnerability does not occur between different instances or between users and non-users of the platform. Single-user instances are not affected. In private instances with a user white-list, the impact is limited by the fact that all potential unintended recipients of these node execution updates must have been admitted by the administrator. This vulnerability is fixed in 0.6.1.
- Product
- AutoGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows.CVE-2025-31491 · Other software · Significant-Gravitas · reported by GitHubHigh 8.6
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows of leakage of cross-domain cookies and protected headers in requests redirect. AutoGPT uses a wrapper around the requests python library, located in autogpt_platform/backend/backend/util/request.py. In this wrapper, redirects are specifically NOT followed for the first request. If the wrapper is used with allow_redirects set to True (which is the default), any redirect is not followed by the initial request, but rather re-requested by the wrapper using the new location. However, there is a fundamental flaw in manually re-requesting the new location: it does not account for security-sensitive headers which should not be sent cross-origin, such as the Authorization and Proxy-Authorization header, and cookies. For example in autogpt_platform/backend/backend/blocks/github/_api.py, an Authorization header is set when retrieving data from the GitHub API. However, if GitHub suffers from an open redirect vulnerability (such as the made-up example of https://api.github.com/repos/{owner}/{repo}/issues/comments/{comment
- Product
- AutoGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2025AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows.CVE-2025-31490 · Other software · Significant-Gravitas · reported by GitHubHigh 7.5
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardening the application against SSRF. The code for this wrapper can be found in autogpt_platform/backend/backend/util/request.py. The requested hostname of a URL which is being requested is validated, ensuring that it does not resolve to any local ipv4 or ipv6 addresses. However, this check is not sufficient, as a DNS server may initially respond with a non-blocked address, with a TTL of 0. This means that the initial resolution would appear as a non-blocked address. In this case, validate_url() will return the url as successful. After validate_url() has successfully returned the url, the url is then passed to the real request() function. When the real request() function is called with the validated url, request() will once again resolve the address of the hostname, because the record will not have been cached (due to TTL 0). This resolution may be in the "invalid range". This type of attack is c
- Product
- AutoGPT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.CVE-2025-32111 · Other software · acme.sh project · reported by MITREHigh 8.7
The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.
- Product
- acme.sh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder: Privilege EscalationCVE-2025-2075 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.
- Product
- Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder
- Affected
- up to 6.3.0.2
- What to do
- Affects up to 6.3.0.2. Update Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 2, 2025canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with.CVE-2025-31479 · Other software · canonical · reported by GitHubHigh 8.2
canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated—causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited—the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1.
- Product
- get-workflow-version-action
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions.CVE-2025-0508 · Other software · aws · reported by security@huntr.devMedium 5.9
A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.
- Product
- aws/sagemaker-python-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix.CVE-2024-8551 · Other software · modelscope · reported by security@huntr.devCritical 9.1
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.
- Product
- modelscope/agentscope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt.CVE-2024-8156 · Other software · significant-gravitas · reported by security@huntr.devCritical 9.8
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.
- Product
- significant-gravitas/autogpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.