Search: 1.2.4.4

A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes the SeaTable Trigger node's API token to be saved in error execution data. This occurs because failed poll requests store raw request headers, exposing sensitive API tokens to users who can view workflow executions but do not have credential read access.

n8n versions prior to 1.123.85, 2.43.5, and 2.44.1 contain a regular expression denial of service (ReDoS) vulnerability. Authenticated users who can create and run workflows may exploit this by submitting crafted glob patterns with excessive wildcards, causing exponential backtracking. This results in blocking the event loop and making the UI, API, webhooks, and health checks unresponsive until the system is restarted.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.

A vulnerability in n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 causes credential secrets to be stored in execution error data for certain nodes. This exposure allows users who can view workflow executions but lack credential read permissions to recover sensitive Git passwords or tokens, MongoDB database passwords, or Google access tokens.

n8n versions before 1.123.85, 2.43.5, and 2.44.1 contain an authorization bypass vulnerability. This flaw allows authenticated users to access credentials they should not have permission to use by exploiting inline sub-workflow nodes with non-boolean disabled values. Attackers who know a credential ID can run Execute Workflow nodes in inline JSON mode to bypass permission checks and exfiltrate decrypted credentials to attacker-controlled servers.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.

CVE-2026-118640 is an authorization bypass vulnerability in n8n versions before 1.123.85, 2.43.5, and 2.44.1. It affects the Chat Hub feature, allowing users with the global:chatUser role to register restricted tool types and execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents beyond their intended permissions.

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

CVE-2026-118260 is a high-severity vulnerability in the Echo Go web framework versions 4.0.0 through 4.16.0. The opt-in BodyDump middleware reads entire request bodies into memory and retains full response bodies without limits, allowing unauthenticated clients to cause uncontrolled memory consumption. This can lead to exhaustion of process memory through large or repeated requests and responses. The issue is fixed in version 4.16.1.

Red Hat has released a security update for the kpatch live kernel patch module targeting kernel version 6.12.0-211.16.1.el10_2. This update addresses multiple vulnerabilities in the Linux kernel, including issues in netfilter ebtables, pppoe header handling, network bridge fast-leave behavior, packet hard header length consistency, and xfrm ah6 routing header validation. The update is rated as Important by Red Hat Product Security.

MIME::Parser versions before 5.521 for Perl do not limit the number of message parts by default, which can lead to memory exhaustion. The default max_parts option was set to -1, disabling limits and allowing a parser to build entities for every message part regardless of quantity. Version 5.521 introduces default limits of max_parts to 1000 and max_depth to 64, mitigating this issue. Users can still disable these limits by setting these options to -1.

HTTP::Body versions before 1.24_01 for Perl contain a vulnerability where a specially crafted multipart upload filename can cause CPU exhaustion due to regex backtracking. The multipart parser uses a regex to find the suffix of the uploaded filename, and filenames with many dots ending in a backslash cause quadratic-time regex backtracking. This allows a remote attacker to exhaust CPU resources with a single request, as matching a basename of about 32 KB can take several seconds.

HTTP::Body versions before 1.24_01 for Perl have a vulnerability that allows remote attackers to exhaust memory by sending specially crafted chunked request bodies. The parser buffers chunks in memory until complete, but malformed chunk-size lines or excessively large sizes cause the parser to wait indefinitely and grow the buffer unboundedly.

HTTP::Body versions before 1.23_01 for Perl contain a vulnerability where the multipart parser does not limit the size or number of lines in a multipart part header block. This allows a remote attacker to exhaust server memory by sending a single crafted request with an unbounded multipart header.

CVE-2026-93536 is a use-after-free vulnerability in the GestureBuildSprite() function of the X.Org X Server and XWayland. It affects versions before 21.1.25 of X.Org X Server and before 24.1.14 of XWayland. Authenticated X clients could exploit this flaw to crash the X server or potentially execute arbitrary code.

A buffer overread vulnerability exists in the CheckKeySyms() function of X.Org X Server versions before 21.1.25 and XWayland versions before 24.1.14. Authenticated X clients could exploit this flaw to leak small amounts of memory information or potentially cause the X server to crash.

A heap buffer overflow vulnerability exists in X.Org X Server before version 21.1.15 and XWayland before version 24.1.14. This flaw is triggered by a XIPassiveUngrabDevice request with an out-of-range modifier value. Authenticated X clients could exploit this to crash the X server or potentially execute arbitrary code within the server context.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where the restriction on deserializing certain nested configuration objects is not consistently enforced. This flaw allows attackers to bypass root element checks and potentially inject nested objects into the configuration.

Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, have a vulnerability where HTTP Basic authentication requests, including those using an API token, can obtain a "remember me" cookie. This allows attackers who have obtained a user's API token to maintain access to Jenkins via the "remember me" cookie even after the API token is revoked or expires.