https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 10:57:22 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110873 <p>Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow&#39;s error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner&#39;s decrypted credentials are injected and exfiltrated.</p> <p>Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow&#39;s error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner&#39;s decrypted credentials are injected and exfiltrated.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110873 https://db.gcve.eu/vuln/ghsa-wh8c-wx4r-x3rj <p>Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow&#39;s error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner&#39;s decrypted credentials are injected and exfiltrated.</p> <p>Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow&#39;s error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner&#39;s decrypted credentials are injected and exfiltrated.</p> https://db.gcve.eu/vuln/ghsa-wh8c-wx4r-x3rj