CVE-2026-103250

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to acce...

CVE-2026-103260 n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advan...

EUVD-2026-90654

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advan...

CVE-2026-103250 n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to acce...

EUVD-2026-90644

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to acce...

CVE-2026-103250

The automation platform n8n versions before 1.123.80, 2.39.6, and 2.40.1 is vulnerable to a NoSQL injection within the MongoDB Chat Memory node. The root cause is a failure to validate the sessionId parameter, allowing unauthenticated attackers to inject MongoDB query operators. This vulnerabilit...

CVE-2026-103250 n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat Memory node that fails to validate the sessionId parameter. Unauthenticated attackers can supply MongoDB query operators in the sessionId field to acce...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE Этот репозиторий содержит Доказательство концепции PoC для уязвимости CVE-2025-62222. Он демонстрирует, как можно добиться удаленного выполнения кода RCE на машине разработчика, манипулируя контекстом GitHub Copilot Chat в VS Code с помощью скрытой...

MobSF_AI

MobSF AI Sidecar Этот проект добавляет чат-ассистента на базе ИИ в Mobile Security Framework MobSF. Он позволяет аналитикам безопасности задавать вопросы об отчете анализа, сгенерированном MobSF, прямо в интерфейсе, используя модель OpenAI. Возможности Бесшовная интеграция : Внедряет...

autogpt-CVE-2026-30950-poc

AutoGPT CVE-2026-30950 POC CVE-2026-30950에 대한 개념 증명PoC 데모입니다. AutoGPT Platform에서 인증된 IDOR권한 누락 취약점으로, 로그인한 사용자가 세션에 대한 사전 접근 권한 없이 단일 PATCH 요청을 통해 다른 사용자의 채팅 세션을 재할당하여 가로챌 수 있습니다. GHSA: GHSA-q58p-v9r9-7gqj CVE: CVE-2026-30950 CVSS 3.1: 7.1 / High AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L 대상:...

PT-2026-103615

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 through 0.8.0 Description A code injection issue exists where a skill uploaded via the '/api/v1/skills/upload' endpoint can subsequently be executed through the '/api/v1/chat/react-agent' flow. Recommendations At the...

CVE-2024-31026

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

보안 권고: 불충분한 접근 제어로 인한 무단 방 삭제 허용 Let's Chat 할당된 CVE ID: CVE-2026-66751 요약 DELETE /rooms/:room는 로그인 요구 외에는 어떠한 권한 검사도 수행하지 않습니다. 어떤 계정이든 서버의 모든 방을 보관 처리할 수 있으며, 해당 계정이 읽거나, 참여하거나, 수정할 수 없는 비공개 및 비밀번호 보호 방도 포함됩니다. 보관archiving은 Let's Chat에서 방을 삭제하는 방식입니다. 방은 방 목록에서 사라지고, 직접 조회하면 404를 반환하며, 해당 방에 메시지...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

보안 권고: 확인되지 않은 Room 조회로 인한 서버 크래시 Let's Chat 할당된 CVE ID: CVE-2026-66749 요약 로그인한 계정에서 보낸 단 한 번의 HTTP 요청으로 Let's Chat 서버 프로세스가 종료됩니다. GET /messages는 room 매개변수를 받아 해당 room을 id로 조회한 다음, 조회 결과가 반환되었는지 확인하지 않고 결과에 대해 메서드를 호출합니다. 어떤 room에도 속하지 않는 유효한 24자리 16진수 문자열 id를 보내면 결과적으로 TypeError가 Mongoose 콜백 내부...

CVE-2024-31026

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

PT-2026-102822

Name of the Vulnerable Software and Affected Versions Greek Universities Network GUnet Open eClass Platform version 3.15 Description A remote attacker can execute arbitrary code through the chat input field within the course module. This issue is a code injection, which occurs when an application...

CVE-2024-31026: Undefined Security Weakness

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

CVE-2024-31026

The Greek Universities Network (GUnet) Open eClass Platform v.3.15 is vulnerable to a code injection flaw. A remote attacker can exploit the chat input field within the course module to execute arbitrary code on the system. To remediate this issue, users should update the platform to a version th...

EUVD-2024-55775

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

Uncontrolled Resource Consumption

Apache Tomcat is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to improper resource management in the WebSocket chat example application, which allows an attacker to consume excessive server resources and potentially cause a denial-of-service condition...