34Selen

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions 17.0.0 through 17.0.14 Nextcloud versions 18.0.0 through 18.1.11 Nextcloud versions 19.0.0 through 19.1.15 Nextcloud versions 20.0.0 through 20.1.10 Nextcloud versions 21.0.0 through 21.0.3 **Description** An Access Control List (ACL) permission bypass exists in team folders. A user granted READ and CREATE permissions, but lacking UPDATE permissions, can unauthorizedly rename files within the team folder. **Recommendations** Update to version 17.0.15 Update to version 18.1.12 Update to version 19.1.16 Update to version 20.1.11 Update to version 21.0.4

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1 **Description** The '/chat' WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature fails to verify if an incoming connection is authorized to interact with the target execution. An unauthenticated remote attacker who identifies a valid execution ID for a workflow in a waiting state can attach to that execution, receive the pending prompt intended for the legitimate user, and submit arbitrary input to resume or influence downstream workflow behavior. **Recommendations** Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.4.0 n8n versions prior to 1.121.0 **Description** n8n is a workflow automation platform. When Lightweight Directory Access Protocol (LDAP) authentication is enabled, n8n automatically links an LDAP identity to an existing local account if the LDAP email attribute matches the local account's email. An authenticated LDAP user who can control their LDAP email attribute can set it to match another user's email, including an administrator's, and gain full access to that account upon login. The account linkage persists even if the LDAP email is reverted, resulting in a permanent account takeover. LDAP authentication must be configured and active for this to occur. **Recommendations** Upgrade to n8n version 2.4.0 or later. Upgrade to n8n version 1.121.0 or later. If upgrading is not immediately possible, disable LDAP authentication until the instance can be upgraded. If upgrading is not immediately possible, restrict LDAP directory permissions so that users cannot modify their own email attributes. If upgrading is not immediately possible, audit existing LDAP-linked accounts for unexpected account associations.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0 **Description** Discourse is an open source discussion platform. Trust Level 4 (TL4) users could publish topics into staff-only categories using the `publish to category` topic timer, bypassing intended authorization controls. **Recommendations** Update to Discourse version 2025.12.2 or later. Update to Discourse version 2026.1.1 or later. Update to Discourse version 2026.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 3.1.0 through 3.1.6 **Description** An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access. **Recommendations** Upgrade to Apache Airflow version 3.1.7 or later.