漏洞公告

n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

n8n has a Python Task Runner Sandbox Escape Vulnerability

n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure

n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration

n8n Vulnerable to Hijacking of Unauthenticated Chat Execution

n8n has SQL Injection in SeaTable Node

n8n has Open Redirect in MCP OAuth Consent Flow

n8n has SQL Injection in Oracle Database Node via Limit Field

n8n has SQL Injection in Snowflake and MySQL Nodes

ipl/web is vulnerable to reflected XSS by malformed search requests

appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution

Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services

OpenID Connect nonce generated but never validated — ID token replay attack

GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE

GoBGP has Remote Denial of Service (Panic) via Malformed Well-known Path Attribute

CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution

fabric-sdk-java has ObjectInputStream.readObject() without ObjectInputFilter, which allows Java deserialization RCE

CKAN has CSRF exemption primed by anonymous requests

CKAN has no certificate validation on STMP connection

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled

OneCollector exporter reads unbounded HTTP response bodies