1417 matches found
CVE-2025-61917 n8n Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe and Buffer.allocUnsafeSlow in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the sa...
EUVD-2025-206795
n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe and Buffer.allocUnsafeSlow in the task runner allowed untrusted code to allocate uninitialized memory. Such uninitialized buffers could contain residual data from within the sa...
CVE-2025-61917
CVE-2025-61917 affects the open‑source workflow tool n8n (versions 1.65.0 through before 1.114.3). The root cause is the use of Buffer.allocUnsafe() / Buffer.allocUnsafeSlow() inside the Task Runner, allowing untrusted code to allocate uninitialized memory that may contain residual data (prior re...
PT-2026-5931
Name of the Vulnerable Software and Affected Versions n8n versions 1.65.0 through 1.114.2 Description n8n is a workflow automation platform. The use of Buffer.allocUnsafe and Buffer.allocUnsafeSlow in the task runner allowed untrusted code to allocate uninitialized memory. This could result in...
CVE-2025-61728 vulnerabilities
Vulnerabilities for packages: agentbeat-fips, conftest-fips, prometheus-mongodb-exporter, packer-fips, coredns-fips, flux, apm-server, kubernetes-dashboard, steampipe, osv-scanner, falco-no-driver, flux-helm-controller-fips, kubeflow-katib, mattermost, conftest, src,...
CVE-2025-61730 vulnerabilities
Vulnerabilities for packages: kyverno-policy-reporter-plugins-trivy-fips, ratify, cass-operator-fips, azure-service-operator-fips, flux, rabbitmq-cluster-operator, apm-server, kyverno-policy-reporter-plugins-trivy, nrdot-collector-k8s, azuredisk-csi-fips,...
GHSA-GR56-3GP6-6GMJ vulnerabilities
Vulnerabilities for packages: kyverno-policy-reporter-plugins-trivy-fips, ratify, cass-operator-fips, azure-service-operator-fips, flux, rabbitmq-cluster-operator, apm-server, kyverno-policy-reporter-plugins-trivy, nrdot-collector-k8s, azuredisk-csi-fips,...
CVE-2025-61731 vulnerabilities
Vulnerabilities for packages: kyverno-policy-reporter-plugins-trivy-fips, ratify, cass-operator-fips, nats-server-config-reloader-fips, azure-service-operator-fips, flux, rabbitmq-cluster-operator, apm-server, kyverno-policy-reporter-plugins-trivy, nrdot-collector-k8s, helm-docs,...
GHSA-CM6P-QC7V-M3JW vulnerabilities
Vulnerabilities for packages: kyverno-policy-reporter-plugins-trivy-fips, ratify, cass-operator-fips, nats-server-config-reloader-fips, azure-service-operator-fips, flux, rabbitmq-cluster-operator, apm-server, kyverno-policy-reporter-plugins-trivy, nrdot-collector-k8s, helm-docs,...
CVE-2025-11065 vulnerabilities
Vulnerabilities for packages: bank-vaults, jitsucom-bulker...
CVE-2025-11065 vulnerabilities
Vulnerabilities for packages: k9s-fips, jitsucom-bulker, pluto-fips, beats, grafana, docker-compose-fips, kyverno, neuvector-sigstore-interface-fips, kyverno-notation-aws-fips, grafana-fips, beats-fips, gitlab-cng-fips, bank-vaults, istio-fips, zitadel, ratify-fips, tkn-fips, boring-registry-fips...
Unsafe Deserialization in PHPT Code Coverage Handling
Overview A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious...
CVE-2026-0863 Sandbox escape in n8n Python task runner allows for arbitrary code execution on the underlying host.
Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissio...
CVE-2025-14235
Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. : Satera LBP670C Series/Satera MF750C Series firmware v06....
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the EnvoyExtensionPolicy resource. An attacker can execute arbitrary commands and access sensitive credentials by injecting malicious Lua scripts. This can lead to privilege escalation, theft of secrets, and...
CVE-2025-11246
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner...
CVE-2025-11246 Insufficient Granularity of Access Control in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner...
CVE-2024-2874
An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources...