4 matches found
CVE-2026-100858
The heym software, in versions prior to 0.0.109 , is vulnerable to a Server-Side Request Forgery (SSRF) in the Slack, Discord, and Crawler workflow nodes . The root cause is the use of an unguarded HTTP client that issues requests to URLs provided in user-created credentials (specifically webhook...
helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-59197 via pillow (8.3.0)
pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-59197 Source advisory: OSV:GHSA-XJ96-63GP-2GMR...
Authorization Bypass Through User-Controlled Key
Overview @n8n/instance-ai is an Instance AI is the agent runtime behind the AI assistant experience in n8n. It lets users ask for help with workflows, executions, credentials, nodes, and workflow building from inside an n8n instance. Affected versions of this package are vulnerable to Authorizati...
