28 matches found
EUVD-2026-74274
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node...
NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
GHSA-34FF-336R-5Q23 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...
CVE-2026-86082
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...
CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...
CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...
CVE-2026-86082
n8n , an open source workflow automation platform, is affected by a domain-restriction bypass in the OpenAI Chat Model node . The root cause is that the searchModels code path in loadModels.ts omitted the assertOpenAiCredentialAllowsUrl check, meaning the credential allowed-domain restrictions en...
CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...
PT-2026-88513
Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...
EUVD-2008-2532
Malware in sbrugna...
EUVD-2025-14085
Malicious code in bioql PyPI...
CVE-2025-48265
Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...
CVE-2025-48265
Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...
CVE-2025-48265: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Pektsekye Year Make Model Search for WooCommerce ymm-search allows Cross Site Request Forgery.This issue affects Year Make Model Search for WooCommerce: from n/a through = 1.0.11...
CVE-2025-4376
CVE-2025-4376 : Sparx Systems Pro Cloud Server’s WebEA model search field is affected by an improper input validation causing Cross-Site Scripting (XSS). Impact applies to Pro Cloud Server versions earlier than 6.0.165. Remediation: upgrade to version 6.0.165 or later. Exploitation details are no...
CVE-2025-4376 Cross-Site Scripting vulnerability in Model Search in Pro Cloud Server's WebEA
Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting XSS. This issue affects Pro Cloud Server: earlier than 6.0.165...
CVE-2025-4376: Improper Neutralization of Input During Web Page Generation
Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting XSS. This issue affects Pro Cloud Server: earlier than 6.0.165...
torrid.com XSS vulnerability
Open Bug Bounty ID: OBB-457140 Description| Value ---|--- Affected Website:| torrid.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
