🔐 Critical cjose JWE Flaw Exposes Encrypted Data
Operators using cjose for JWE encryption should patch immediately and identify affected ciphertext. Re-encrypt data created with the vulnerable algorithms and rotate any secrets that may have been exposed.
CVE-2026-53939 affects OpenIDC/cjose, a C library implementing JOSE, where AES-CBC-HMAC JWE encryption can generate an all-zero CEK instead of a random key. The vulnerability is rated CRITICAL with CVSS 9.1 and can allow attackers who obtain affected JWEs to recover plaintext or forge modified content. The issue is fixed in cjose version 0.6.2.6.
🔗 Read more 🔗
Source: NVD
⚠️ cjose AES Key Wrap Bug Enables Heap Corruption
Teams running applications that decrypt untrusted JWEs should upgrade cjose quickly. Until patched, disable affected AES Key Wrap algorithms for attacker-controlled input.
CVE-2026-53938 affects OpenIDC/cjose versions prior to 0.6.2.5, where AES Key Wrap JWE decryption does not validate attacker-controlled encrypted key lengths before writing to a fixed-size CEK buffer. The vulnerability is rated HIGH with CVSS 8.2 and can cause heap corruption, denial of service, or potentially further memory corruption. The issue is fixed in cjose 0.6.2.5.
🔗 Read more 🔗
Source: NVD
🔓 Maravel JWT Cache Issue Allows Token Replay
Administrators running Maravel or affected JWT authentication setups should review blacklist cache behavior and apply the documented workaround or fixed configuration. Prioritize internet-facing APIs where replayed tokens could access sensitive resources.
CVE-2026-55250 affects Maravel versions prior to 10.74.0 and involves a Token Replay Vulnerability caused by a lifecycle mismatch between token validation and cache handling. The vulnerability is rated HIGH with CVSS 8.7 and can allow stolen or revoked tokens to become valid again under affected cache conditions. The issue requires configuration changes or updated cache handling to mitigate.
🔗 Read more 🔗
Source: NVD
🛡️ OPNsense NTP Module Bug Allows Root File Writes
OPNsense administrators should patch firewall appliances urgently because root-level file overwrite capability can lead to full device compromise. Restrict configuration access until updates are deployed.
CVE-2026-53581 affects OPNsense firewall and routing platform versions before the listed fixes, where a path traversal issue in the NTP configuration module allows arbitrary file overwrites as root. The vulnerability is rated CRITICAL with CVSS 9.0 and can allow attackers with access to NTP configuration to write user-controlled data anywhere on the filesystem. The issue is fixed in opnsense/core version 26.1.9 and BE/opnsense/core version 26.4_20.
🔗 Read more 🔗
Source: NVD
⚙️ n8n Expression Engine Flaw Risks Code Execution
n8n administrators should update quickly, especially where workflow editors are not fully trusted. Review editor permissions because expression engine issues can affect backend automation execution.
CVE-2026-86083 affects n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 due to unsafe source generation in the legacy expression engine. The vulnerability is rated HIGH with CVSS 7.7 and can allow attacker-controlled code paths through manipulated expressions. The issue does not affect the vm expression engine and is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
🔗 Read more 🔗
Source: NVD
🤖 n8n OpenAI Node Can Leak Credentials
n8n operators using OpenAI integrations should patch promptly and review workflow editor access. Check exposed credentials and endpoint controls after updating.
CVE-2026-86082 affects n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 because the OpenAI Chat Model node did not enforce allowed-domain restrictions for model-search requests. The vulnerability is rated HIGH with CVSS 7.1 and could send OpenAI API credentials to an attacker-controlled host. The issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
🔗 Read more 🔗
Source: NVD
🚨 n8n Git Node Regex Bug Can Freeze Instances
n8n administrators should patch shared automation environments quickly, especially where many users can create workflows. Limit workflow authoring access until the fix is applied.
CVE-2026-86081 affects n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 due to catastrophic backtracking in the Git node clone operation regular expression. The vulnerability is rated HIGH with CVSS 7.1 and can allow an authenticated workflow editor to freeze an instance through a crafted workflow execution. The issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
🔗 Read more 🔗
Source: NVD
💻 n8n Sandbox Bypass Enables Code Execution
Organizations running n8n with untrusted workflow creators should treat this as urgent and update immediately. Review permissions because sandbox bypass vulnerabilities can lead to broader compromise.
CVE-2026-86076 affects n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 where expression compiler sanitization can be bypassed through reserved class member names. The vulnerability is rated HIGH with CVSS 8.7 and can enable backend code execution and editor-preview JavaScript execution. The issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
🔗 Read more 🔗
Source: NVD
📦 n8n OAuth Bug Risks Database Exhaustion
Administrators exposing n8n OAuth registration endpoints should patch quickly and monitor database growth. Restrict unnecessary public access until the update is complete.
CVE-2026-86075 affects n8n versions prior to 2.37.7 and 2.38.2 where OAuth Dynamic Client Registration accepts oversized client_name and grant_types values. The vulnerability is rated HIGH with CVSS 8.7 and can allow unauthenticated remote attackers to exhaust database storage by repeatedly persisting large values. The issue is fixed in versions 2.37.7 and 2.38.2.
🔗 Read more 🔗
Source: NVD
🎵 Waves Central macOS Helper Grants Root Access
macOS administrators with Waves Central installed should apply the update promptly, especially on shared systems. Local privilege escalation issues matter most on machines with multiple users or sensitive workloads.
CVE-2026-86819 affects Waves Central for macOS due to improper validation of clients connecting to its privileged helper service. The vulnerability is rated HIGH with CVSS 7.1 and allows a local authenticated user to execute scripts with root privileges. The issue is fixed in version 17.0.
🔗 Read more 🔗
Source: NVD
🔑 Auth0 AD/LDAP Connector Bug Enables Code Execution
Administrators managing Auth0 AD/LDAP Connector deployments should apply vendor fixes and review local host access. Prioritize connector servers running with elevated service permissions.
CVE-2026-85983 affects the Auth0 AD/LDAP Connector, which improperly processes a configuration value during service startup. The vulnerability is rated HIGH with CVSS 7.8 and can allow a low-privileged local user to modify configuration and execute code with service account privileges. The issue affects systems running the vulnerable connector.
🔗 Read more 🔗
Source: NVD
🚨 Auth0 AD/LDAP Connector Stored XSS Hits Admins
Teams operating Auth0 AD/LDAP Connector should patch urgently and review who can modify directory attributes or connector data. Stored XSS in admin panels can compromise privileged administrator sessions.
CVE-2026-85982 affects the Auth0 AD/LDAP Connector through stored Cross-Site Scripting caused by improper HTML encoding in search results and updater log content shown in the admin panel. The vulnerability is rated CRITICAL with CVSS 9.0 and can allow malicious scripts to execute in an administrator’s browser. The issue can be triggered by manipulated directory attributes or updater log content.
🔗 Read more 🔗
Source: NVD