PT-2026-63990

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.3.3 Description When using the IN PLACE mode, the software fails to sanitize DOM elements that originate from a different window or realm, such as an iframe's contentDocument. This occurs because a cross-real...

PT-2026-64170

Name of the Vulnerable Software and Affected Versions victor Web versions prior to 7.1 Description Johnson Controls victor Web on Windows contains an issue related to improper privilege management CWE-269, which may allow privilege escalation CAPEC-233. Recommendations Update victor Web to versio...

PT-2026-64165

Name of the Vulnerable Software and Affected Versions victor versions 2.9 through 2.9 Description An issue exists in the Windows version of the software where the deserialization of untrusted data allows for CAPEC-586, which refers to the process of converting data from a stream or file back into...

Oracle VM VirtualBox (CVE-2026-47054) (July 2026 CPU)

The 7.2.12 version of VM VirtualBox installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily...

NPM: n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

NPM: n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

GHSA-FPG6-X68Q-5793 n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

Impact The shell tool in the @n8n/computer-use package applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands executed by the tool ran without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the...

n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows

Impact The shell tool in the @n8n/computer-use package applied its sandbox restrictions only on macOS. On Linux and Windows, shell commands executed by the tool ran without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the...

CVE-2026-13192

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...

Command Injection

Overview @n8n/computer-use is a Local AI gateway for n8n AI Assistant — filesystem, shell, screenshots, mouse/keyboard, and browser automation Affected versions of this package are vulnerable to Command Injection via the Shell tool activation path in...

Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the...

GHSA-4V35-78JC-648R Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpg6-x68q-5793. This link is maintained to preserve external references. Original Description n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Red Hat JBoss Web Server 6.2.4 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2026-65590

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

CVE-2026-65590

Summary: CVE-2026-65590 affects n8n before 2.29.8 and 2.30.x before 2.30.1 due to missing shell sandbox enforcement in the @n8n/computer-use package on Linux/Windows (macOS sandbox exists). It allows shell commands to run with unrestricted filesystem and network access from the computer-use agent...

EUVD-2026-47634

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

CVE-2026-42305

A flaw was found in Dulwich, a pure-Python implementation of the Git file formats and protocols. A remote attacker could exploit this vulnerability by enticing a user on a Windows system to clone or check out a specially crafted malicious Git repository. This could lead to an arbitrary file write...

EUVD-2026-46540

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious file...