EUVD-2026-42350

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks...

NPM: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

NPM: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads vulnerability discovered by ? in WordPress Npm n8n versions 1.123.58...

GHSA-W867-JM58-P9PV n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs,...

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs,...

NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects

NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects vulnerability discovered by ? in WordPress Npm n8n versions 2.28.0...

EUVD-2026-42268

n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects...

GHSA-GV7G-JM28-CR3M n8n: Expression sandbox escape via arrow-function bodies enabling command execution

Impact An authenticated user with permission to create or modify workflows could abuse crafted expressions using arrow functions to bypass the expression sandbox, triggering unintended system command execution on the host running n8n. Patches The issue has been fixed in n8n versions 2.31.5 and...

GHSA-RCV6-PVRJ-4XCG n8n: Authenticated code execution in the n8n Git node

Impact Authenticated n8n users with rights to create and execute workflows could achieve code execution on the n8n host. Using the Git node, under the default git security settings, by staging a crafted local repository, an attacker could cause git to run hooks, executing arbitrary commands as th...

n8n: Authenticated code execution in the n8n Git node

Impact Authenticated n8n users with rights to create and execute workflows could achieve code execution on the n8n host. Using the Git node, under the default git security settings, by staging a crafted local repository, an attacker could cause git to run hooks, executing arbitrary commands as th...

Command Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Command Injection via the Git node. An attacker can execute arbitrary commands as the application process user by crafting a local repository to trigger git hooks during workflow execution. Note: Th...

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' via the legacy expression evaluator's computed-member sanitizer. An attacker can...

GHSA-9W78-79Q7-R4FP n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

Impact An authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression. When an HTTP Header Auth credential is applied to a paginated request, the secret is present...

CVE-2026-64794

The Users Anywhere and Articles Anywhere Joomla extensions by regularlabs.com are vulnerable to restricted user-data exposure. The root cause is that user tags, filters, and conditions allow access to insufficiently restricted user fields. An attacker could use crafted content to expose sensitive...

CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions

Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or...

CVE-2026-64794 Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions

Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or...

EUVD-2026-47811

Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the...

CVE-2026-63684

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks...

CVE-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...

CVE-2026-13055 Server crash via aggregation pipeline expression with compound wildcard index specification

The $internalIndexKey aggregation expression can be used by any authenticated user to crash a MongoDB server mongod. The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an...