CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

EUVD-2026-47640

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

CVE-2026-65596 n8n before 1.123.64 Credential Exfiltration via GraphQL Node

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

EUVD-2026-47635

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

EUVD-2026-47591

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

EUVD-2026-47583

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

EUVD-2026-46581

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise...

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

PT-2026-63462

Name of the Vulnerable Software and Affected Versions mongod affected versions not specified Description An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. This...

PT-2026-63479

An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries...

PT-2026-63459

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with permissions to execute aggregation pipelines can cause a MongoDB server mongod to crash. This occurs when the $ internalIndexKey aggregation expression is used with...

PT-2026-63466

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write privileges on a collection enabled with Queryable Encryption can modify internal encryption metadata fields that should be controlled by the server. This occu...

PT-2026-71917

Name of the Vulnerable Software and Affected Versions jupyterlab versions 4.5.0 through 4.5.9 jupyterlab versions 4.6.0 through 4.6.1 Description The PyPI extension manager in JupyterLab fails to properly enforce blocked extensions uris because it uses a custom normalization process that is weake...

PT-2026-63330

Name of the Vulnerable Software and Affected Versions Page Builder CK versions prior to 3.6.2 Description An improper access control issue allows authenticated users to perform an arbitrary file upload, which can lead to Remote Code Execution RCE, a state where an attacker can execute arbitrary...

PT-2026-63481

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

PT-2026-63461

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue in the server's Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and...