n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

## Impact Authenticated n8n users with workflow create/execute rights could use the Git node's fetch, pull, or push-tag

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

## Impact The credential "Allowed HTTP Request Domains" allowlist was intended to restrict which hosts a credential's s

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

## Impact In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, t

历史摘要 · 未重新核验 · GitHub Advisory

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

CVE-2026-65016

## Impact n8n's Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution

CVE-2026-65591

## Impact The legacy expression evaluator's computed-member sanitizer can be bypassed by an authenticated user with work

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

CVE-2026-65595

## Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acti

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

CVE-2026-59208

## Impact When an n8n instance is configured with more than one trusted token-exchange issuer, external identities are r

历史摘要 · 未重新核验 · GitHub Advisory

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

CVE-2026-59207

## Impact The AI Agents feature did not enforce the "Allowed HTTP Request Domains" restriction configured on credentials

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

CVE-2026-59206

## Impact An authenticated user with the default `workflow:create` permission could pollute `Object.prototype` through a

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

CVE-2026-59209

## Impact An authenticated member with use-only editor access to a shared workflow could read credential-populated heade

历史摘要 · 未重新核验 · GitHub Advisory

Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

CVE-2026-59901

The `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a m

历史摘要 · 未重新核验 · GitHub Advisory

Netty: TOCTOU in OcspServerCertificateValidator

CVE-2026-56822

### Summary Netty's OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

CVE-2026-56821

### Summary `OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an e

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

CVE-2026-56820

### Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested Certif

历史摘要 · 未重新核验 · GitHub Advisory

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

CVE-2026-56817

Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declar

历史摘要 · 未重新核验 · GitHub Advisory

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

CVE-2026-56816

### Summary Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload le

历史摘要 · 未重新核验 · GitHub Advisory

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

CVE-2026-56745

The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initia

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate

历史摘要 · 未重新核验 · GitHub Advisory

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6...

CVE-2026-8989

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through e

历史摘要 · 未重新核验 · GitHub Advisory

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that...

CVE-2026-8988

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of th

历史摘要 · 未重新核验 · GitHub Advisory