Remote code execution in Microsoft Office Word allows an unauthenticated network attacker to execute arbitrary code on a victim's machine by delivering a specially crafted document that triggers a null pointer dereference. Affected versions span Microsoft Word 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft 365 Apps for Enterprise, and Office LTSC for Mac variants. Microsoft has released patches across all affected product lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution via a double-free memory corruption flaw (CWE-415) in Microsoft Office Word enables an unauthenticated network-reachable attacker to execute arbitrary code on a victim's machine when the victim opens or previews a specially crafted document (UI:R). The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full host compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and a vendor-released patch is available through Microsoft's Security Response Center.
Heap-based buffer overflow in Windows Management Services enables a network-reachable, low-privileged authenticated attacker to escalate privileges with high impact across confidentiality, integrity, and availability on affected Windows systems. The vulnerability spans a broad range of Windows releases from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H1, making the remediation surface unusually wide. No public exploit code has been identified at time of analysis, but the low attack complexity and network reachability make this a high-priority patch-cycle item.
Heap-based buffer overflow in Microsoft Office Word enables remote unauthenticated attackers to achieve full code execution (C:H/I:H/A:H) by delivering a specially crafted Word document to a target user across all major Office suite versions on both Windows and macOS. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016, with fixed version thresholds confirmed by EUVD. No public exploit or CISA KEV listing identified at time of analysis, but the network-vector, no-auth delivery model is highly attractive for phishing-based initial access campaigns. Vendor-released patch is available via Microsoft Security Response Center.
Heap-based buffer overflow in Microsoft Office Word's document-parsing engine enables remote code execution when a victim opens a specially crafted file, yielding full confidentiality, integrity, and availability compromise of the user's session. Affected products span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Word 2016, and corresponding macOS editions across both x86 and x64 architectures. No public exploit identified at time of analysis, but the AV:N/PR:N/UI:R CVSS pattern is historically associated with rapid phishing-campaign weaponization for Office document vulnerabilities.
Heap-based buffer overflow in Windows Media Player enables network-delivered remote code execution across 15 Windows OS SKUs, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. An unauthenticated remote attacker who can entice a user to open a crafted media file triggers memory corruption yielding full code execution at the victim's privilege level (C:H/I:H/A:H). No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the ubiquitous Windows footprint and well-understood heap-overflow exploit class warrant priority patching.
Remote code execution in Windows Routing and Remote Access Service (RRAS) allows a low-privileged network attacker to fully compromise affected Windows systems via a heap-based buffer overflow in the RRAS service. The vulnerability spans an unusually wide range of releases - Windows Server 2012 through Server 2025 and Windows 10/11 - suggesting a systemic flaw in a shared RRAS code path. Microsoft has released patches through its Security Update Guide (MSRC); no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker to execute arbitrary code with full system impact across a broad range of Microsoft Windows releases. The vulnerability (CWE-122) affects Windows 10, Windows 11, and Windows Server 2012 through 2025, with vendor-released patches available via MSRC. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low authentication bar (PR:L) and wide platform coverage make this a high-priority patch for any organization operating RRAS-enabled servers.
Heap-based buffer overflow in Microsoft's Windows Data Access Components (WDAC) OLE DB provider for SQL enables remote unauthenticated code execution on client systems across virtually every current and legacy Windows release. An attacker hosting a malicious SQL/OLE DB server endpoint can corrupt heap memory in the victim's OLE DB provider process when the user initiates a connection, achieving full C:H/I:H/A:H impact. Vendor patch is available via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Remote Access Connection Manager (RASMAN) service allows authenticated network attackers to achieve full system compromise through an integer underflow vulnerability. All actively supported Windows releases from Server 2012 through Windows 11 25H2 and Windows Server 2025 are affected, making the blast radius exceptionally broad across enterprise and consumer environments. Microsoft has released patches through the standard Patch Tuesday update channel; no public exploit code or active exploitation is confirmed at time of analysis.
Heap-based buffer overflow in Windows Paint (mspaint) enables remote code execution across virtually all supported Windows versions when a user opens a specially crafted image file. Reported by secure@microsoft.com and tracked as EUVD-2026-73086, this CWE-122 flaw carries a CVSS 8.8 with high impact across confidentiality, integrity, and availability, exploitable by unauthenticated attackers requiring only user interaction. Microsoft has released patches covering affected versions from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Player enables remote code execution across a broad swath of Microsoft Windows versions, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-delivered exploitation requiring a user to open a malicious media file, with full confidentiality, integrity, and availability impact upon success. Microsoft has released patches across all affected version branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Imaging Component (WIC) enables unauthenticated remote code execution across a broad swath of Microsoft Windows desktop and server editions from Server 2012 through Windows 11 26H1. Exploitation requires user interaction - a victim must open or process a maliciously crafted image file - after which an attacker achieves full C/I/A compromise of the targeted system. No public exploit code has been identified at time of analysis, and vendor patches are available for all affected version lines.
Use-after-free in the Windows Hello authentication subsystem on Windows 10 and 11 allows a locally authenticated, low-privileged user to escalate privileges beyond their security boundary. The CVSS scope-change indicator (S:C) confirms that successful exploitation crosses into a more privileged security context - likely SYSTEM or kernel-level - with full confidentiality, integrity, and availability impact. Vendor patch is available via Microsoft's update guide; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow in the Windows Network File System (NFS) component enables remote attackers to execute arbitrary code on unpatched Windows Server and Windows 10/11 systems where NFS services are active. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with no privilege requirement but a user-interaction dependency - consistent with a client-side NFS processing scenario or triggered NFS operation. Microsoft has released patches covering a span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution across all currently-supported Office editions when a victim opens a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Office 2016 through 2024 LTSC on both x86 and x64 platforms, the vulnerability requires no attacker privileges but depends on user interaction - the classic malicious-document delivery model. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating, full confidentiality/integrity/availability impact, and the near-universal enterprise footprint of Microsoft Office make this a high-priority patching candidate.
Stack-based buffer overflow in Microsoft Office Word's document parsing engine allows remote unauthenticated attackers to execute arbitrary code with the privileges of the victim user when a specially crafted Word document is opened. The flaw (CWE-121) spans Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and Word 2016 on both Windows and macOS. Microsoft has released patched builds; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in Windows Hello on Windows 11 allows a low-privileged local attacker to gain SYSTEM-level or kernel-level access via a use-after-free memory corruption flaw (CWE-416). Affected builds span all currently supported Windows 11 feature releases (23H2, 24H2, 25H2, and 26H1) prior to Microsoft's July 2026 security update. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low complexity and absence of required user interaction make this a high-value second-stage escalation primitive.
Stack-based buffer overflow in Microsoft Word (CWE-121) enables remote code execution by enticing a user to open a maliciously crafted document, with full compromise of confidentiality, integrity, and availability. Affected products span Office 2019, 2021, and 2024 LTSC on both Windows (x86/x64) and macOS, as well as Microsoft 365 Apps for Enterprise and Word 2016. Microsoft has released patches across all affected product lines; no public exploit code has been identified and CISA KEV confirmation is absent at time of analysis.
Remote code execution in the Windows Key Distribution Center (KDC) - the Kerberos authentication service running on every Active Directory domain controller - allows a low-privileged authenticated network attacker to execute arbitrary code via a use-after-free memory corruption flaw (CWE-416). Every currently-supported Windows Server release from Server 2012 through Server 2025 is affected, spanning the full breadth of enterprise Active Directory infrastructure. Microsoft has released patches with exact build-level thresholds per platform; no public exploit code and no CISA KEV listing are identified at time of analysis.
Stack-based buffer overflow in Microsoft Word's document-parsing engine enables network-delivered remote code execution with full system impact across all current Microsoft Office product lines on Windows and macOS. The vulnerability (CWE-121) is triggered when a user opens a specially crafted Word document, overflowing a fixed-size stack buffer and allowing an attacker to hijack control flow and execute arbitrary code in the context of the logged-in user. Affected versions span Word 2016 through Microsoft 365 Apps for Enterprise and LTSC editions on both x86/x64 Windows and macOS; patches are available per vendor advisory, and no public exploit code has been identified at time of analysis.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Heap-based buffer overflow in Microsoft Office Word's document parsing engine enables an unauthenticated remote attacker to achieve full code execution on a victim's system when a specially crafted Word document is opened. The flaw spans all major currently-supported Office release channels on both Windows and macOS, including Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, Word 2016, and macOS editions. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity, broad product footprint, and well-understood Office document exploitation tradecraft make this a high-priority patching candidate.
Heap-based buffer overflow in Windows Raw Image Extension (versions 2.1.0.0 through <2.4.24.0) enables remote code execution when a victim opens or previews a specially crafted raw camera image file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that no attacker authentication is required - only user interaction with a malicious file - yielding full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis, but the file-parsing attack surface and high CVSS impact make this a meaningful priority for environments with photography workflows.
Heap-based buffer overflow in the Windows iSCSI service allows an authenticated, network-accessible attacker with low-level privileges to execute arbitrary code on affected systems. The vulnerability spans an exceptionally broad set of Windows releases - from Server 2012 and Windows 10 through Windows 11 26H1 and Server 2025 - making patch surface management a significant operational challenge for enterprise environments. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network vector and full CIA impact yield a CVSS score of 8.8.
Heap-based buffer overflow in Windows Hyper-V enables a low-privileged guest VM user to escape the hypervisor sandbox and execute arbitrary code on the host system. The CVSS scope-change metric (S:C) and C:H/I:H/A:H impact ratings confirm this is a full VM-escape class vulnerability, giving an attacker inside a guest complete control over the underlying Hyper-V host. Affected versions span Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through Server 2025; Microsoft has released patches via Windows Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables network-delivered remote code execution across virtually all supported Windows versions when a user opens a crafted media file. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects low-complexity exploitation requiring no privileges but necessitating user interaction - the classic pattern of a malicious media file delivered via email, web, or file share. Affected scope spans Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, making this a broad, high-priority patch item for nearly every enterprise environment. No public exploit or CISA KEV listing identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft Office Word enables unauthenticated remote code execution when a victim opens a specially crafted document. All currently supported Office product lines are affected across Windows (x86/x64) and macOS, including Microsoft 365 Apps for Enterprise, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 for Mac. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected products and full C/I/A impact make this a high-priority patching item across virtually all enterprise environments.
Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. Microsoft has released patches for all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Remote Desktop Client (mstsc.exe and related components) allows a low-privileged attacker to execute arbitrary code on the victim client machine via a network connection. The root cause is CWE-908 (use of uninitialized resource), where memory that has not been properly initialized can be manipulated by a malicious RDP server to hijack execution flow on the connecting client. The vulnerability affects the RDP client component across a broad range of Windows releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit or KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and high C/I/A impact make this a priority patching target.
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker to achieve privilege escalation - and given the full C:H/I:H/A:H CVSS impact, effectively arbitrary code execution - on affected systems when a user interacts with attacker-controlled content. Affected are .NET 8.0 through 11.0 RC1 and Visual Studio 2022/2026 across multiple release trains. The Microsoft Security Response Center disclosed and patched the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Media Foundation enables remote code execution across a wide range of Windows 10, Windows 11, and Windows Server releases. An unauthenticated network attacker can trigger the overflow by inducing a target user to open or process a crafted media file, resulting in full compromise of confidentiality, integrity, and availability at the process level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions and the low attack complexity (AC:L) make this a significant patching priority.
Heap-based buffer overflow in Microsoft Office Word enables remote code execution when a victim opens a specially crafted document. Exploitation requires no attacker privileges but does require user interaction, making phishing-delivered malicious documents the expected delivery mechanism. The full C:H/I:H/A:H impact triad indicates complete system compromise upon successful exploitation; no public exploit code or active exploitation has been confirmed at time of analysis.
Remote code execution against the Windows Remote Desktop Client is achievable by an unauthenticated network attacker who induces a victim to connect to a malicious RDP server, triggering a CWE-122 heap buffer overflow in the client process with full C:H/I:H/A:H impact. The affected surface spans all actively supported Windows versions from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025, as well as end-of-life Windows Server 2012 and 2012 R2. A vendor patch is available via Microsoft's update channel; no public exploit code and no CISA KEV entry have been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM allows a low-privileged authenticated attacker to execute arbitrary code on the server by exploiting unsafe deserialization of attacker-controlled data. All versions prior to 2026.2 are affected, per CPE cpe:2.3:a:ivanti:neurons_for_itsm:*:*:*:*:*:*:*:*. The CVSS 8.8 score reflects network reachability, low complexity, and full confidentiality, integrity, and availability impact - no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Ivanti Neurons for ITSM before version 2026.2 is achievable by any authenticated remote attacker through deserialization of untrusted data (CWE-502). The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity network exploitation requiring only a standard user account, with full confidentiality, integrity, and availability compromise of the server. No public exploit code or active exploitation has been identified at time of analysis, but Ivanti ITSM platforms have historically attracted significant attacker attention.
Privilege escalation in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker with low privileges to elevate their access to full administrator. The root cause is CWE-862 (Missing Authorization) - one or more API or functional endpoints fail to enforce role-based access controls, permitting any authenticated user to invoke admin-level operations. No public exploit code or CISA KEV listing is identified at time of analysis, but Ivanti EPMM has a well-documented history of targeted exploitation in prior CVE cycles.
PHP Object Injection in the Live Composer - Free WordPress Website Builder plugin (all versions ≤ 2.1.18) enables authenticated attackers with contributor-level access to inject arbitrary PHP objects via deserialization in the plugin's downloads module. Real-world impact is entirely conditional on whether a Property-Oriented Programming (POP) chain is present in a co-installed plugin or theme; without one, exploitation produces no tangible effect. When a POP chain is available, consequences can include arbitrary file deletion, sensitive data extraction, or remote code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Eval injection (CWE-95) in Adobe ColdFusion 2023 (≤Update 23) and ColdFusion 2025 (≤Update 12) enables unauthenticated, network-based arbitrary code execution without user interaction. User-supplied input reaching a dynamic code evaluation function is processed without sanitization, allowing injected CFML or Java expressions to execute server-side as the application user. The CVSS scope-change metric (S:C) indicates the impact can extend beyond the ColdFusion process itself; Adobe PSIRT issued formal advisory APSB26-119. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signature verification routine: when the incoming `auth_algo` header value cannot be mapped to a supported hash function, the verification function incorrectly returns `true`, causing the application to accept fabricated webhook payloads as legitimate PayPal events. Any XenForo installation with PayPal REST payment integration enabled prior to version 2.3.13 is affected. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable against the webhook endpoint by any network-accessible attacker.
Remote code execution in n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 is achievable by any authenticated user who can author workflow expressions. The root cause is a sandbox escape in the PrototypeSanitizer AST hook: because the sanitizer references itself via dynamically scoped `this`, a crafted class field named `__sanitize` rebinds the sanitizer function, after which the expression freely invokes the JavaScript `Function()` constructor and executes arbitrary Node.js code on the backend. No public exploit has been identified at time of analysis, but the Function constructor escape technique is well-documented in the JavaScript security research community, lowering the barrier to independent rediscovery.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss.
Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment.
Unauthenticated information disclosure in AVideo through 29.0 exposes private live-stream credentials - including stream keys and m3u8 playlist URLs - to any network-accessible attacker who queries the unprotected `plugin/Live/stats.json.php` endpoint. The `hidden_applications` array in the JSON response contains metadata for private, unlisted, and group-restricted live streams that the platform explicitly intends to conceal from unauthorized viewers. No public exploit has been identified at time of analysis, but the vulnerability is trivially reachable given its zero-precondition CVSS 4.0 profile (AV:N/AC:L/AT:N/PR:N/UI:N, score 8.7).
Unvalidated input sizes on the OAuth Dynamic Client Registration endpoint in n8n allow unauthenticated remote attackers to exhaust database storage by repeatedly submitting oversized client_name and grant_types values. Affected versions are all n8n releases prior to 2.37.7 (in the 2.37.x branch) and prior to 2.38.2 (in the 2.38.x branch). Because the endpoint is publicly accessible without authentication and the attack is trivially automatable, a single attacker can render the n8n instance unavailable by filling database disk capacity, taking down all workflow automation for any organization relying on the platform.