n8n-MCP 安全漏洞

n8n-MCP is a model context protocol server developed by Romuald Członkowski, an individual developer. It serves as a connection between AI assistants and automated workflow platforms. Versions of n8n-MCP from 2.18.7 to 2.50.2 contained security vulnerabilities. These vulnerabilities were caused b...

PT-2026-39186

Name of the Vulnerable Software and Affected Versions Amazon Redshift JDBC Driver versions prior to 2.2.2 Description An issue allows the driver to load and execute arbitrary classes when processing JDBC connection URL parameters. An actor capable of influencing the connection URL could potential...

TOTOLINK X5000R 缓冲区错误漏洞

The TOTOLINK X5000R is a router produced by TOTOLINK, a Chinese electronics company. The version 9.1.0u.6369B20230113 of the Totolink X5000R contains a buffer error vulnerability. This vulnerability stems from improper handling of the submit-url parameter in the function sub458E40 within the...

Angular 代码问题漏洞

Angular is an open-source development platform created by Angular. It is used to build mobile and desktop web applications using TypeScript/JavaScript and other languages. There were code-related vulnerabilities in versions prior to Angular 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8. These...

PT-2026-39263

Name of the Vulnerable Software and Affected Versions MCP Registry versions prior to 1.7.7 Description The public catalogue UI served at the 'GET /' endpoint is subject to stored cross-site scripting. This occurs via the server.websiteUrl field of published server.json files. The server-side...

PT-2026-39011

Name of the Vulnerable Software and Affected Versions Langfuse versions 3.68.0 through 3.166.0 Description A role-based access control flaw exists in the LLM connection update flow. An authenticated user with the "member" role in a project can request an update to an existing LLM connection by...

Vim 操作系统命令注入漏洞

Vim is an open-source, cross-platform text editor developed by Vim developers. Versions of Vim prior to 9.2.0383 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the netrw standard plugin, which allowed for OS command injection. This could...

PT-2026-39189

Name of the Vulnerable Software and Affected Versions n8n-MCP versions 2.18.7 through 2.50.1 Description An authenticated server-side request forgery SSRF issue exists affecting the webhook trigger tools, the n8n API client N8N API URL, and per-request URLs provided via the x-n8n-url header in...

Magnitude Simba Amazon Redshift JDBC Driver 安全漏洞

The Magnitude Simba Amazon Redshift JDBC Driver is a JDBC driver provided by the American company Magnitude. It enables database connection through the standard JDBC Application Programming Interface API available in the Java Platform Enterprise Edition. Versions of the Magnitude Simba Amazon...

PT-2026-38664

Name of the Vulnerable Software and Affected Versions Totolink X5000R version 9.1.0u.6369 B20230113 Description A buffer overflow occurs in the sub 458E40 function within the '/boafrm/formDdns' file. This issue is triggered by the manipulation of the submit-url argument, allowing for remote...

CVE-2026-44578

creationtimestamp| type| source ---|---|--- 2026-05-07 23:40:51+00:00| seen| https://bsky.app/profile/securestep9.bsky.social/post/3mlcfbrg7m62h 2026-05-08 03:00:06+00:00| seen| Telegram/xvoYgOFnUf5jFw65bW2FC7fcn6orx4l4LTjm0d68ZkOEzo 2026-05-08 12:09:44+00:00| seen|...

CVE-2026-2838

creationtimestamp| type| source ---|---|--- 2026-05-07 22:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlcbilx2oi2g...

utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Summary The utcp-http plugin is vulnerable to a blind Server-Side Request Forgery SSRF caused by a trust-boundary inconsistency between manual discovery and tool invocation. registermanual validates the discovery URL against an HTTPS / loopback allowlist, but calltool and calltoolstreaming reuse...

CVE-2026-8142

creationtimestamp| type| source ---|---|--- 2026-05-07 22:07:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlca2zkgkf2q...

CVE-2026-39836

creationtimestamp| type| source ---|---|--- 2026-05-07 22:02:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc7s2lbje2v 2026-05-08 12:01:27+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mldoo2vosj2d 2026-05-15 16:19:42+00:00| seen|...

CVE-2026-42449

creationtimestamp| type| source ---|---|--- 2026-05-07 21:51:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc75hcav22e 2026-05-07 23:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlcftqxeo72p 2026-05-18 02:07:08+00:00| seen|...

CVE-2026-3477

creationtimestamp| type| source ---|---|--- 2026-05-07 21:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlc65d5hxu2i...

CVE-2026-42501

creationtimestamp| type| source ---|---|--- 2026-05-07 21:23:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc5lyf2ry2c...

CVE-2026-44742

creationtimestamp| type| source ---|---|--- 2026-05-07 21:19:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc5eyncrc2r 2026-06-19 12:45:12+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e6ba9994-41dc-45f7-b8e9-ac330a61d59b 2026-06-23...

CVE-2026-8034

A server-side request forgery SSRF vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a differe...