134396 matches found
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77083
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
EUVD-2026-63271
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...
EUVD-2026-63266
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77077
n8n versions before 1.123.69, 2.33.4, and 2.34.1 have a VM sandbox escape in the task runner: the prototype-freezing routine misses internal constructors like EventEmitter, allowing an authenticated user with Code node access to pollute prototypes and execute arbitrary commands. The corruption is...
CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...
ROOT-APP-NPM-GHSA-PM4M-PH32-GHV5 GHSA-pm4m-ph32-ghv5 in js-yaml - Patched by Root
Root has patched GHSA-pm4m-ph32-ghv5 in the js-yaml package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-73643 CVE-2026-73643 in js-yaml - Patched by Root
Root has patched CVE-2026-73643 in the js-yaml package for Root:npm. Multiple fixed versions available...
GHSA-RMMH-P597-PPVV vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
CVE-2026-59711 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
Security update for python-pytest-html (important)
openSUSE security update: security update for python-pytest-html ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21602-1 Rating: important References: bsc1275374 bsc1275437 Cross-References: CVE-2026-73088 CVE-2026-73089 CVSS scores: CVE-2026-73088...
PT-2026-79120
Name of the Vulnerable Software and Affected Versions OpenSearch Dashboards versions prior to 3.8 Description Improper input validation in the Time Series Visual Builder TSVB plugin allows an authenticated remote user to execute arbitrary code on the server. This is achieved by sending a crafted...
PT-2026-80769
Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. proto gcPolluted causes the converter to resol...
PT-2026-80271
Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. proto gcPolluted causes the converter to resol...
CVE-2026-18420: Improperly Controlled Modification of Object Prototype Attributes
Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...