519 matches found
CVE-2026-77074
n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...
CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node
n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...
CVE-2026-77074
n8n versions before 1.123.69 contain a server-side request forgery (SSRF) vulnerability in the Edit Image node's Draw Text operation . Authenticated users can inject MVG primitives through crafted text values, enabling blind outbound HTTP requests to arbitrary addresses or access to local files. ...
CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node
n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...
CVE-2026-74444
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAWPRIMITIVES header size before division vmwcmddraw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...
PT-2026-72896
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate DRAW PRIMITIVES header size before division vmw cmd draw computes maxnum = header-size - sizeofcmd-body / sizeofdecl; where header-size is u32 and is taken straight from the user-supplied command stream. When...
Astra Linux – Vulnerability in Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: usb:dwc3:gadget: Move vbus draw to workqueue context Currently, dwc3gadgetvbusdraw can be called from an atomic context, which in turn invokes APIs from power-supply-core. Some of these PMIC APIs have operations that may enter a...
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...
CVE-2026-50758
Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter...
CVE-2026-50756
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component...
CVE-2026-50757
Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server...
CVE-2026-50758
CVE-2026-50758 describes a Cross Site Scripting vulnerability in DayuanJiang’s next-ai-draw-io (version 0.4.13) where an attacker can remotely execute arbitrary code via the mcp parameter. Technical details across multiple trusted sources confirm the affected software and the vulnerability patter...
CVE-2026-50756
CVE-2026-50756 affects DayuanJiang’s DayuanJiang next-ai-draw-io v0.4.13, with the vulnerability residing in the x-ai-provider component. The included metrics indicate a network-accessible issue with high impact on confidentiality (C:H) but no integrity or availability impact, and no user interac...
CVE-2026-50755
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...
CVE-2026-50757
Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server...
CVE-2026-50756
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component...
CVE-2026-50755
CVE-2026-50755 affects DayuanJiang’s next-ai-draw-io 0.4.13. The issue enables an attacker to obtain sensitive information by manipulating the X-Forwarded-For header, leading to potential information disclosure. The publicly provided details describe the vulnerability as a remote-access risk with...
PT-2026-62084
Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code. This is achieved by manipulating the mcp parameter. Recommendations At the moment, there is no...
PT-2026-62082
Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A remote attacker can obtain sensitive information through the x-ai-provider component. Recommendations At the moment, there is no information about a newer version that contains a fix for...