267281 matches found
CVE-2026-85170: Improper Input Validation
n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...
PT-2026-85002
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 Description Authenticated users with workflow execution privileges can exploit the Gmail v1 and Brevo nodes by providing an expression that resolves to an...
CVE-2026-85446: Inefficient Algorithmic Complexity
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic...
PT-2026-85000
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...
PT-2026-85253
Name of the Vulnerable Software and Affected Versions node-csv versions prior to 7.0.2 Description When the columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This...
Linux Distros Unpatched Vulnerability : CVE-2026-65165
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The vulnerability exists due to a logic processing flaw when handling job steps using an arbitrary node distribution, leading to node count discrepancies...
PT-2026-85298
Name of the Vulnerable Software and Affected Versions MOOS-IvP pMarineViewer versions prior to 24.8.2 Description An issue exists where the software fails to limit the number of tracked node identities received from NODE REPORT messages. An unauthenticated attacker can publish crafted NODE REPORT...
UBUNTU-CVE-2026-65165
Fix various issues around job steps and node count discrepancies...
CVE-2026-65165
Fix various issues around job steps and node count discrepancies...
PT-2026-85078
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment PoC+ consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative...
CVE-2026-85168: Improper Neutralization of Special Elements used in an OS Command
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...
PT-2026-85295
Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description A quadratic processing issue exists in uFldNodeComms where the creation of a new node identity generates a ledger entry and triggers all-pairs distribution work. An attacker can provide an unlimite...
Malicious code in bby-node-logger (npm)
Source: ossf-package-analysis 746efea78f0fad1fcf28d697e7f458ab59c43a6f5442e8088d91a83474bc0c20 The OpenSSF Package Analysis project identified 'bby-node-logger' @ 4.2.2 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...
Malicious code in backend-configstore-node-sass-firebase (npm)
Source: amazon-inspector ef6b9ac0075b325abe952216f78ce9a11d4101d6d1aabdbee5e7aff20ac8216e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in babel-node (npm)
The package babel-node was found to contain malicious code. --- Credit: OpenSSF source...
@capillarytech/creatives-library (7.12.19), @htmlgoddess/cli (>=0.3.5, <=0.4.4) +25 more potentially affected by unknown CVE via babel-node (0.0.1-security)
babel-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on babel-node and may be impacted: - @capillarytech/creatives-library 7.12.19 - @htmlgoddess/cli =0.3.5, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.2.0, =0.0.1, =0.0.7, =0.1.9 -...
Malicious code in azure-service-bus-emulator-node-sample (npm)
Source: ossf-package-analysis 871b655dee4c193ddb7e1b7be9e6a50920aa93049ffc2e663d74a7a5cc79ebff The OpenSSF Package Analysis project identified 'azure-service-bus-emulator-node-sample' @ 10.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associate...
Malicious code in azure-documentdb-node (npm)
Source: ossf-package-analysis 6ae212af083dc32114fe6584d59ab57ac5b5c3b77d59d83cd62af05f8706cdf0 The OpenSSF Package Analysis project identified 'azure-documentdb-node' @ 9.9.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...
Malicious code in axios-docusaurus-node-sass-html-webpack-plugin (npm)
Source: amazon-inspector edbb6d2fb12bad9e44295778236ba91dbbdac0b8e668c461c5030b7c439e518a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...