CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

PT-2026-64984

Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description A use-after-free flaw exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, which the exprComputeOperands function subsequently accesses....

PT-2026-64983

Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description An issue exists in the expression parsing and memory management logic. After the sqlite3ExprDelete function is called to release an expression object, the program retains a dangling pointer and accesses member...

sqlite: SQLite: Arbitrary code execution via malicious SQL statement

A flaw was found in SQLite. A use-after-free vulnerability in the expression evaluation logic, specifically within the sqlite3ReleaseTempReg and exprComputeOperands functions, allows a remote attacker to exploit the system. By supplying a malicious SQL statement, an attacker can cause a denial of...

K000162436: Spring Web Flow vulnerability CVE-2026-40985

Security Advisory Description Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1. CVE-2026-40985 Impact There is no impact; F5 products are not...

CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates

Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...

CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

n8n - Remote Code Execution via Expression Injection

n8n 1.120.4, 1.121.1, 1.122.0 contains a remote code execution caused by insufficient isolation in workflow expression evaluation, letting authenticated attackers execute arbitrary code with n8n process privileges. Exploit requires authentication. id: CVE-2025-68613 info: name: n8n - Remote Code...

GHSA-652Q-GVQ3-74QV n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

EUVD-2026-42269

n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation...

GHSA-HWMJ-QG4V-CVG9 n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The legacy MySQL v1 node's executeQuery operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. If a workflow uses this operation with expression-sourced values in the query and is connected to an externally-reachable trigger such as...

GHSA-JP7M-XCGX-57QM n8n: External Secrets Permission Bypass via Expression Parser Mismatch

Impact Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user with credential create or update permissions, but without the externalSecret:list scope, could embed external secret references into credentials in forms the validation did not...

Prototype Pollution

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Prototype Pollution in the expression engine. An attacker can cause the application to become unresponsive or crash by manipulating array-element access to obtain a reference to a host built-in an...

GHSA-HX4H-VR3M-45VH n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service

Impact An authenticated user able to create or edit a workflow expression could abuse the expression engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process, leading to a denial of service. Both self-hosted and cloud instances runni...

GHSA-6QC9-MQVW-JG7X n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

Impact An authenticated member with edit access to a shared workflow could reference another user's credential in an HTTP Request node while specifying the credential type through an expression. Because the pre-execution permission check compared the unresolved expression instead of the real...

GHSA-GV7G-JM28-CR3M n8n: Expression sandbox escape via arrow-function bodies enabling command execution

Impact An authenticated user with permission to create or modify workflows could abuse crafted expressions using arrow functions to bypass the expression sandbox, triggering unintended system command execution on the host running n8n. Patches The issue has been fixed in n8n versions 2.31.5 and...

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with workflow create or modify permissions. Successful exploitation grants the attacker host-level code execution as the n8n process. The legacy expression engine is the default engine in...

NPM: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

NPM: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...