PT-2026-85298

Name of the Vulnerable Software and Affected Versions MOOS-IvP pMarineViewer versions prior to 24.8.2 Description An issue exists where the software fails to limit the number of tracked node identities received from NODE REPORT messages. An unauthenticated attacker can publish crafted NODE REPORT...

PT-2026-85248

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.2.0 Description A remote unauthenticated attacker can cause a denial of service in Node.js applications by providing a specially crafted TOML document. The toml.parse function uses a recursive-descent parser that...

CVE-2026-48486: Integer Overflow or Wraparound

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment PoC+ consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative...

PT-2026-85247

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.1.2 Description the toml.parse function in lib/compiler.js allows an attacker to write arbitrary keys onto Object.prototype by routing a table path through a scalar value. This occurs because the deepRef function...

CVE-2026-85393: Improper Verification of Cryptographic Signature

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...

CVE-2026-85170: Improper Input Validation

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-65165

Fix various issues around job steps and node count discrepancies...

CVE-2026-63376: Improperly Controlled Modification of Object Prototype Attributes

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and...

UBUNTU-CVE-2026-65165

Fix various issues around job steps and node count discrepancies...

PT-2026-85002

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.73 n8n versions prior to 2.35.4 n8n versions prior to 2.36.2 Description Authenticated users with workflow execution privileges can exploit the Gmail v1 and Brevo nodes by providing an expression that resolves to an...

PT-2026-85078

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment PoC+ consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative...

CVE-2026-85172: Server-Side Request Forgery (SSRF)

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

Linux Distros Unpatched Vulnerability : CVE-2026-65165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix various issues around job steps and node count discrepancies CVE-2026-65165 Note that Nessus relies on the...

CVE-2026-85166: Incorrect Authorization

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

PT-2026-84948

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A flaw exists in the pmdomain: mediatek component where the scpsys get bus protection legacy function improperly handles device-tree nodes. In two error paths, the system calls of node p...

PT-2026-85278

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without...

PT-2026-85253

Name of the Vulnerable Software and Affected Versions node-csv versions prior to 7.0.2 Description When the columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This...

CVE-2026-85446: Inefficient Algorithmic Complexity

MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers can supply unbounded distinct node names in reports to drive the shoreside broker into quadratic...

CVE-2026-77465: Uncontrolled Recursion

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse uses a Peggy 5.1.0 generated recursive-descent parser in lib/parser.js whose peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse through nested arrays and inline tables without a depth...

CVE-2026-85168: Improper Neutralization of Special Elements used in an OS Command

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...