CVE-2026-72767

The CVE covers n8n prior to 1.123.67, and 2.x prior to 2.31.5 (and 2.32.x prior to 2.32.1), with a remote code execution flaw in the Git node. Authenticated users who can create/execute workflows can stage a crafted local repository, causing Git to run hooks under default security settings and ex...

CVE-2026-72767 n8n before 1.123.67 Remote Code Execution via Git node

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...

PT-2026-70169

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...

CVE-2026-72884 Dokploy: Command Injection via Compose Custom Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an...

CVE-2026-72869

Dokploy (PaaS) contains an authenticated OS command injection in backup.restoreBackupWithLogs. Before v0.29.13, the tRPC backup.restoreBackupWithLogs path passes the databaseName into nested shell text executed by Node.js exec, allowing a user with backup:restore permission to craft a databaseNam...

CVE-2026-72866 WebSocket Terminal Auth Bypass

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /terminal?serverId=local, select the special...

CVE-2026-72862 Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull $dockerImage shell commands on th...

EUVD-2026-55687

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the createCommand function constructs shell commands by interpolating compose service names and configuration into bash command strings. When a compose with a maliciously crafted name or service definition is deployed,...

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability CVSS score: 10.0, which does not carry a CVE identifier, allows an unauthenticated remote attacker ...

xalgorix v4.5.125

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Rocket.Chat v8.7.0

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

Rocket.Chat v8.7.0-rc.6

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

CVE-2026-48086

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...

NPM: Nx: Zip-Slip in the self-hosted remote cache

NPM: Nx: Zip-Slip in the self-hosted remote cache vulnerability discovered by ? in WordPress Npm nx versions = 20.8.0, 22.7.7...

GHSA-VP3H-GHGH-JR7G Nx: Zip-Slip in the self-hosted remote cache

Summary The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path MITM — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the...

Nx: Zip-Slip in the self-hosted remote cache

Summary The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path MITM — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

EUVD-2026-54250

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...