CVE-2026-86074

n8n (open-source workflow automation platform) prior to 2.37.7 and 2.38.2 is affected by a flaw in the Instance AI credential setup flow . The flow accepted a credential test or verification URL without verifying it matched the workflow node's origin, allowing attacker-controlled fetched content ...

CVE-2026-86711

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711

electerm versions before 5.3.15 are affected by an arbitrary command execution vulnerability in the runGlobalAsync Electron IPC handler (src/app/lib/ipc.js). The handler exposes over 40 main-process functions without a function-name allowlist or sender validation, allowing renderer-side script ex...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

CVE-2026-86711 electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

ROS-20260908-73-0022

The vulnerability in Helm is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2026-88504

Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...

CVE-2026-86540

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...

CVE-2026-86540

Knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files. An attacker who crafts a malicious .knowns/config.json file in a repository can cause the unvalidated binary path to be executed twice under the user's account with no verificati...

CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51015 PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket for STARTBREAK and CRACKBREAK actions or in UseItemTransactionData typically within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets with invalid facing values e.g., negative or...

CVE-2022-51013

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. An authenticated remote attacker can send negative or out-of-range damage values in itemstack NBT data, triggering unhandled exceptions in the Durable class and causi...

CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

CVE-2022-51013 PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers can send negative or out-of-range damage values in itemstack NBT to trigger unhandled exceptions in the Durable class, causing server crashes...

PT-2026-86930

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description Insufficient validation of filesystem paths in MCP tool arguments allows attackers to perform directory traversal. By supplying path arguments containing traversal sequences, an attacker can read,...

PT-2026-86932

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...