NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

NPM: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: SSRF Protection Bypass via MCP Client Node

NPM: n8n: SSRF Protection Bypass via MCP Client Node vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

n8n: SSRF Protection Bypass via MCP Client Node

Impact On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoint without routing them through that protection and without pinning the resolved address. An authenticated user who could create or edit a workflow could therefore cause the server t...

Server-side Request Forgery (SSRF)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the MCP Client. An attacker can access internal or otherwise restricted network resources by supplying crafted endpoints, causing the server to connect to unintended host...

GHSA-VHF8-CG2H-CG3P n8n: SSRF Protection Bypass via MCP Client Node

Impact On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoint without routing them through that protection and without pinning the resolved address. An authenticated user who could create or edit a workflow could therefore cause the server t...

Server-side Request Forgery (SSRF)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the /rest/dynamic-node-parameters/ endpoint due to insufficient authorization checks and the ability to supply an absolute URL in the routing configuration. An...

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

NPM: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

NPM: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

GHSA-9W78-79Q7-R4FP n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

GO-2026-6038 Gitea: Two SSRF findings in gitea.dev

Gitea: Two SSRF findings in gitea.dev...

GO-2026-6023 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve...

GO-2026-6030 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea...

CVE-2026-13071

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

UBUNTU-CVE-2026-13071

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

CVE-2026-13071

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

UBUNTU-CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

UBUNTU-CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

EUVD-2026-47795

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...