CVE-2026-110849

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110849

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the...

CVE-2026-110849

The n8n platform (versions before 1.123.83 , 2.41.4 , and 2.42.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the file-preview modal . The root cause is that the application re-publishes binary data as an unsandboxed same-origin blob URL . An attacker who uploads a crafted item ...

CVE-2026-110847 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n use...

CVE-2026-110847

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n use...

CVE-2026-110847 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n use...

CVE-2026-110847 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n use...

CVE-2026-110847

The n8n workflow automation tool contains a Stored Cross-Site Scripting (XSS) vulnerability in the Chat Trigger hosted-chat page. This issue exists in versions before 1.123.83 , 2.x before 2.41.4 , and 2.42.x before 2.42.1 . The root cause is the interpolation of insufficiently sanitized customCs...

CVE-2026-0316

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted t...

CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted t...

EUVD-2026-101668

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted t...

CVE-2026-0316 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted t...

CVE-2026-0316

A stored cross-site scripting (XSS) vulnerability exists in Palo Alto Networks PAN-OS software. This flaw allows a malicious authenticated administrator to store or execute a JavaScript payload via the web interface. The vulnerability affects PA-Series and VM-Series firewalls, as well as Panorama...

CVE-2026-54701

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before inserting it into the head of the preview webview document withou...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...