CVE-2026-86078 n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain proto or constructor, causing nested writes t...

CVE-2026-86078

n8n (open-source workflow automation platform) is affected by a prototype pollution vulnerability in the Instance AI workflow summary feature prior to versions 2.37.7 and 2.38.2 . The function summarizeWorkflowStructure (in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts) trea...

Muse, Meta’s New Personal AI Agent, Needs You to Trust It

Designed to compete with OpenClaw and Instinct, the company says Muse can do everything from sell your car to book you a plane ticket...

CVE-2026-86074

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a us...

CVE-2026-86074

n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 is affected by a flaw in the Instance AI credential setup flow . The flow accepted a credential test or verification URL without verifying it matched the workflow node's origin, allowing attacker-controlled fetched content ...

Azure AI Language Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Threat actors are continuing to leverage artificial intelligence AI to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat...

Important: Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.25.11 provides these changes:...

PT-2026-88509

Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the...

Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

CVE-2026-86332

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...

CVE-2026-86332 Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...

CVE-2026-86332

A flaw in the odh-dashboard component of Red Hat OpenShift AI allows any authenticated dashboard user to read Kubernetes Secrets without an authorization check. The backend-for-frontend route GET /api/nim-serving/:nimResource uses the dashboard service account to retrieve and return the full Secr...

CVE-2026-86332

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...

xalgorix v4.6.72

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Crow-Eye v0.13.0

Crow-Eye — Windows Forensics Engine A forensic time machine for Windows. Crow-Eye doesn't just detect — it reconstructs what actually happened on the timeline, from acquisition all the way to a verdict traceable to its source records. Table of Contents Overview ✨ Highlights 👥 Who Crow-Eye Is For ...

PyRIT v1.1.0

Python Risk Identification Tool for generative AI PyRIT The Python Risk Identification Tool for generative AI PyRIT is an open source framework built to empower security professionals and engineers to proactively identify risks in generative AI systems. Check out our website for more information...