Vulnerabilities handled in the n8n workflow automation platform

n8n has identified several vulnerabilities in the n8n workflow automation platform, particularly in versions 1.123.55, 2.24.0, 2.25.7, 2.26.1, and 2.26.2. These vulnerabilities affect various components of the n8n platform. Authorized users with workflow processing rights can exploit...

MAL-2026-6569 Malicious code in longzy-basic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90336f7ef2177c75d9cf4a1872fe94504a382dfd1907e7617e0e06642f2dae67 On npm install, the package's postinstall hook executes .prepare.cjs, which collects the installer's hostname, username, platform, Node version,...

Malicious code in longzy-basic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90336f7ef2177c75d9cf4a1872fe94504a382dfd1907e7617e0e06642f2dae67 On npm install, the package's postinstall hook executes .prepare.cjs, which collects the installer's hostname, username, platform, Node version,...

MAL-2026-6596 Malicious code in @digitalcnzz/embedded-sdk (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

CVE-2026-41896: Improper Authentication

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manualwebhooksecretgithub field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default —...

PT-2026-53665

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to...

PT-2026-53671

Name of the Vulnerable Software and Affected Versions Mythic versions prior to 3.4.0.60 Description An authorization bypass exists that allows authenticated users with the spectator role to perform unauthorized write operations. This occurs because the 'eventing import automatic webhook' endpoint...

CVE-2026-57947: Server-Side Request Forgery (SSRF)

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to...

PT-2026-53660

Name of the Vulnerable Software and Affected Versions Parseable versions prior to 2.9.2 Description An information disclosure issue exists in the notification-target API endpoints where webhook tokens and basic-auth credentials are returned in cleartext. This occurs because the secret-masking...

PT-2026-53739

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474 Description An issue exists where the manual webhook secret github field, used by webhook endpoints to validate incoming requests, is nullable and lacks a default value. For newly created applications,...

Malicious code in @digitalcnzz/embedded-sdk (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

Malicious code in @sailing-package/core (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

MAL-2026-6595 Malicious code in @digitalcnzz/commonmodule (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

MAL-2026-6598 Malicious code in @sailing-package/core (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

Malicious code in @digitalcnzz/commonmodule (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

Malicious code in @longzy/react-native-polyfill (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

MAL-2026-6597 Malicious code in @longzy/react-native-polyfill (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

SUSE CVE-2026-57522

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens, which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template referenc...

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

Summary The GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials — Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram webhook URLs with embedded bot tokens, and Authorization header values — withou...

GHSA-WW5P-J6CJ-6MQQ Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

Summary The GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials — Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram webhook URLs with embedded bot tokens, and Authorization header values — withou...