CVE-2026-86077: Missing Authorization

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-86082: Server-Side Request Forgery (SSRF)

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make t...

CVE-2022-51011

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

CVE-2022-51011 PocketMine-MP before 4.2.10 Denial of Service via Chat Messages

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

EUVD-2022-56040

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

CVE-2022-51011 PocketMine-MP before 4.2.10 Denial of Service via Chat Messages

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

CVE-2022-51011 PocketMine-MP before 4.2.10 Denial of Service via Chat Messages

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

CVE-2022-51011

PocketMine-MP before 4.2.10 is vulnerable to a denial of service caused by insufficient validation of incoming chat message blobs. The server fails to check the total length of chat packets before splitting them on newline characters, allowing a malicious client to send megabyte-sized messages co...

PT-2026-86773

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

CVE-2022-51011: Improper Input Validation

PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...

CVE-2026-86123

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-86123 SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

EUVD-2026-71955

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-86123

SQL Chat is a database connectivity tool that exposes four unauthenticated API endpoints under /api/connection (specifically execute.ts and test.ts). These endpoints accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts, effective...

CVE-2026-86123 SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-86123 SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit

The /v1/chat/agents/agentid/edit endpoint in local-operator versions before 0.47.5 resolves the caller-supplied filepath with expanduser.resolve and reads it without checking that it lies inside the agent's workspace. An unauthenticated client with network access to the API can supply an absolute...

CVE-2026-18404

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18404 Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18404

CVE-2026-18404 affects the Social Chat – Click To Chat App Button (WP WhatsApp Chat) WordPress plugin, versions up to and including 8.6.2 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping of the consent_message JSON attribute ...