CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075

n8n's editor splices resource-locator field values into node URL templates without expression-syntax checks, enabling an authenticated user to inject JavaScript evaluated in another user's session. CVSS 8.4 HIGH. Affected: <1.123.69, 2.x <2.33.4, 2.34.x

EUVD-2026-63264

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

EUVD-2026-63263

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...

CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...

EUVD-2026-63259

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

CVE-2026-77070

n8n (workflow automation tool) is vulnerable in its MongoDB node 's Find, Delete, and Aggregate operations. The Query parameter is parsed as JSON after expression resolution without sanitizing MongoDB operators , allowing an attacker who can influence the resolved query to inject operators like $...

CVE-2026-77070 n8n before 1.123.69 NoSQL Injection via MongoDB Node

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

CVE-2026-77070 n8n before 1.123.69 NoSQL Injection via MongoDB Node

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

CVE-2026-77071

n8n versions before 1.123.69, 2.33.4, and 2.34.1 are vulnerable to PostgREST filter injection in the Supabase node's Row Get Many, Delete, and Update operations, where an expression-bindable value is concatenated into filter queries without escaping, allowing an attacker to widen filters to full-...

EUVD-2026-63260

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...

CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that...

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

CVE-2025-14601

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or...

WordPress Term Pages plugin < 2.0.0 - Unauthenticated SQL Injection via tp_lookup vulnerability

Unauthenticated SQL Injection via tplookup vulnerability discovered by João Ramos Maciel in WordPress Plugin Term Pages versions 2.0.0...

WordPress Download Monitor plugin < 5.2.6 - Unauthenticated Download Log Injection vulnerability

Unauthenticated Download Log Injection vulnerability discovered by Anirudh Gupta in WordPress Plugin Download Monitor versions 5.2.6...

WordPress LogMyTrip plugin <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie vulnerability

Unauthenticated SQL Injection via 'tid' Cookie vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin LogMyTrip versions = 1.9...

WordPress Link Library plugin < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form vulnerability

Unauthenticated SQL Injection via the Front-End Link Submission Form vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Link Library versions 7.9.3...