n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution

n8n versions = 0.123.0 and = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leadin...

EUVD-2026-58505

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

CVE-2026-73659

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-72856 Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

CVE-2026-72856

Budibase before version 3.40.0 contains an authorization/authentication bypass in PUT /api/global/users/tenant/owner (changeTenantOwnerEmail). In self-hosted deployments (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL), cloudRestricted is a no-op and the route is protected only by a general authentication...

CVE-2026-73659

Trigger.dev CVE-2026-73659 affects the open-source platform (Trigger.dev) in versions 4.4.2–4.5.0. The packet presign routes (apps/webapp/app/routes/api.v1.packets.$.ts) pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl/generatePresignedRequest...

CVE-2026-73659 Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-49820

Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...

PT-2026-71911

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELF HOSTED or DISABLE ACCOUNT PORTAL set, the cloudRestricted middleware is a no-op and the route is protected only b...

CVE-2026-73269

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to...

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016 Rendered Artifactory Helm manifests may contain generated TLS private keys

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-66016

CVE-2026-66016 concerns rendered Artifactory Helm manifests produced under specific self-hosted Helm configurations, where generated TLS private keys may be retained and become accessible to highly privileged local users. The CVSS-derived metrics in the initial entry indicate local attack vector,...

PT-2026-71123

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

CVE-2026-71476

A flaw was found in Nx. The self-hosted HTTP remote cache component improperly extracts downloaded cache artifacts, allowing files to be written outside the intended directory. A malicious or on-path Man-in-the-Middle remote cache server can exploit this Zip-Slip vulnerability by providing a...

CVE-2026-72769 n8n before 1.123.67 Prototype Pollution via VM Expression Engine

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...

CVE-2026-72767 n8n before 1.123.67 Remote Code Execution via Git node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...

CVE-2026-72767

The CVE covers n8n prior to 1.123.67, and 2.x prior to 2.31.5 (and 2.32.x prior to 2.32.1), with a remote code execution flaw in the Git node. Authenticated users who can create/execute workflows can stage a crafted local repository, causing Git to run hooks under default security settings and ex...

CVE-2026-72767 n8n before 1.123.67 Remote Code Execution via Git node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...