EUVD-2026-81287

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

PT-2026-94380

Name of the Vulnerable Software and Affected Versions Umbraco versions prior to 13.15.1 Umbraco versions prior to 17.5.3 Umbraco versions prior to 18.0.2 Description The Content Delivery API fails to apply member and Public Access checks to referenced nodes serialized through Content Picker or...

CVE-2026-69197: Exposure of Sensitive Information to an Unauthorized Actor

Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block...

PT-2026-94319

Name of the Vulnerable Software and Affected Versions vm2 versions 3.9.6 through 3.11.6 Description A NodeVM builtin allowlist bypass allows a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin. On Node.js 24+, module.builtinModules exposes the...

RHEL 9 : perl-XML-LibXML (RHSA-2026:68693)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:68693 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...

RHEL 9 : perl-XML-LibXML (RHSA-2026:68688)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:68688 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...

PT-2026-94159

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.4.11 NeuVector versions prior to 5.5.4 NeuVector versions prior to 5.6.2 Description Improper parameter handling in the packet capture mechanism allows an authenticated user with namespaced Runtime Policies write...

PT-2026-105468

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8686-vhfx-7r3j. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny...

PT-2026-94670

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the OCFS2 cluster component where the o2nm node local store function fails to clear the cl has local variable when handling local=0. This creates a stale state that...

PT-2026-94844

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access in the property array occurs when the software node get reference args function is called with an index of UINT MAX representing -1, as the bounds check fails to...

CVE-2026-92587

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587 n8n before 1.123.76 Sandbox Escape via Git Relative URL

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

CVE-2026-92587

n8n (workflow automation platform) contains a sandbox escape in its Git node affecting versions before 1.123.76 , 2.37.7 , and 2.38.2 . The root cause is a validation/resolution mismatch: a relative remote URL is checked against the configured repositoryPath, but git actually resolves it from its...

Security Bulletin: node-tar is a tar archive manipulation library for Node.js vulnerability

Summary node-tar is a tar archive manipulation library for Node.js vulnerability causing an uncatchable RangeError stack overflow. Vulnerability Details CVEID:CVE-2026-73566 DESCRIPTION: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...