CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node ). A shared-workflow editor or any user creating/updating a workflow via the REST API, Public API, or MCP can p...

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

EUVD-2026-70354

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

CVE-2026-80750

CVE-2026-80750 is a use-after-free in the Linux kernel's pmdomain: mediatek driver, specifically in scpsys_get_bus_protection_legacy(). Two error paths call of_node_put() before verifying the regmap lookup succeeded, then pass the potentially freed device node to dev_err_probe() with the %pOF spe...

CVE-2026-80750 pmdomain: mediatek: fix remaining %pOF after of_node_put()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

CVE-2026-80750 pmdomain: mediatek: fix remaining %pOF after of_node_put()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

ROOT-APP-NPM-CVE-2026-25896 CVE-2026-25896 in fast-xml-parser - Patched by Root

Root has patched CVE-2026-25896 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...

CVE-2026-63376: Improperly Controlled Modification of Object Prototype Attributes

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

CVE-2026-85170: Improper Input Validation

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-85172: Server-Side Request Forgery (SSRF)

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

PT-2026-85278

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...

CVE-2026-85063: Improperly Controlled Modification of Object Prototype Attributes

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

PT-2026-85253

Name of the Vulnerable Software and Affected Versions node-csv versions prior to 7.0.2 Description When the columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This...

PT-2026-85293

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description A buffer over-read occurs in the isQuoted, isBraced, and isChevroned functions. These functions strip whitespace from input but continue to index using the original string length, allowing an...

CVE-2026-85166: Incorrect Authorization

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

Linux Distros Unpatched Vulnerability : CVE-2026-65165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The vulnerability exists due to a logic processing flaw when handling job steps using an arbitrary node distribution, leading to node count discrepancies...

PT-2026-85003

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

PT-2026-85295

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description A quadratic processing issue exists in uFldNodeComms where the creation of a new node identity generates a ledger entry and triggers all-pairs distribution work. An attacker can provide an unlimite...

CVE-2026-48486: Integer Overflow or Wraparound

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment PoC+ consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative...