CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72781

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

EUVD-2026-56105

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

CVE-2026-72781

CVE-2026-72781 affects Craft CMS versions 5.0.0-RC1–before 5.10.7 and 4.x RC1–before 4.18.3, where an authenticated control-panel user can trigger a remote code execution via the Twig sandbox escape. The vulnerability arises because Craft marks ElementInterface as safe (AllowedInSandbox) and the ...

CVE-2026-72781 Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

CVE-2026-72769

n8n (versions prior to 1.123.67, 2.31.5, and 2.32.1) contains a prototype pollution vulnerability in the VM expression engine. An authenticated user who can create/edit a workflow expression can abuse array-element access to reference a host builtin and pollute its prototype in the main n8n proce...

EUVD-2026-56095

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...

CVE-2026-72770

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

EUVD-2026-56096

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

CVE-2026-72769 n8n before 1.123.67 Prototype Pollution via VM Expression Engine

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...

CVE-2026-72769 n8n before 1.123.67 Prototype Pollution via VM Expression Engine

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...

CVE-2026-72770 n8n before 1.123.67 Path Traversal via Git Node Operations

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

CVE-2026-72769

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in th...

CVE-2026-72765 n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...

CVE-2026-72765

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...

EUVD-2026-56144

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...

CVE-2026-72765

n8n before 2.31.5 and 2.32.1 is affected by a sandbox escape in its expression evaluation engine. An authenticated user with the ability to create or modify workflows can craft expressions using arrow-function bodies to bypass the sandbox and trigger system command execution (RCE) on the host. NV...

CVE-2026-72765 n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...

CVE-2026-72551

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system, enabling a developer to escape th...