Monthly
A signature bypass in n8n's waiting-webhook endpoint allows attackers who possess a valid resume token for an existing Send-and-Wait execution to approve waiting executions intended for other users, causing downstream workflow actions to run under the workflow owner's credentials, which may include command execution if the workflow is configured to perform such actions. Affects n8n versions before 2.41.4 and 2.42.x before 2.42.1. No public exploit identified at time of analysis; exploitation requires a valid resume token (no authentication to n8n itself is needed beyond the token), and the impact is bounded by the target workflow's downstream nodes. This is a moderate-to-high priority issue for organizations running n8n, but not a drop-everything emergency.
OS command injection in PeaZip before 11.3.0 allows an attacker to run arbitrary commands on a victim's machine by embedding a specially crafted filename in an archive, provided PeaZip is running in a specific non-default configuration. The root cause is mishandling of the 'quotation character already used in the string' condition, which lets the injected filename escape the application's quoting and reach the shell; the CVSS 4.0 vector records no required privileges (PR:N) but explicitly captures attack prerequisites (AT:P), and exploitation is local with user interaction, meaning the victim must open or process the malicious archive. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor has addressed it in PeaZip 11.3.0, and the independent assessment rates this moderate priority - worth patching, but not an emergency.
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_00 through the fix in 0.2026.05.06.15.42.stable_01) lets denylisted, confirmation-required commands auto-execute. Because the non-interactive CLI agent matched command strings against its denylist before stripping leading environment-variable assignments, an attacker able to influence the agent's emitted command output (e.g., via prompt injection) can prefix a blocked command such as 'rm' with 'X=1' to evade the safety boundary. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Linked Data Signature forgery in Fedify (the @fedify/fedify ActivityPub server framework) before 2.2.3 lets remote unauthenticated attackers reshape a third-party-signed activity so it is interpreted differently while its signature still verifies. Because the signature covers the canonical RDF graph rather than the JSON-LD serialization, an attacker who has received a signed activity can use JSON-LD keywords (@graph, @reverse, @included) or context-alias tricks to promote, hide, or rewrite fields and have the forged result accepted as authentic. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the GitHub Security Advisory documents the exact restructuring techniques in detail.
Commit and tag signature confusion in go-git (the pure-Go implementation of Git) lets a crafted Git object carry a signature that validates while its effective metadata differs from what was actually signed. Because go-git parses ambiguous or malformed object headers differently from canonical Git, and because its signing/verification path operates over a reconstructed representation rather than the raw object bytes, an attacker with contributor access can create commits whose displayed author/committer/metadata diverges from the signed payload - undermining downstream trust decisions (the issue was originally surfaced through sigstore/gitsign). Affected releases are go-git v5 before 5.19.0 and v6 alpha builds 6.0.0-alpha.1 through 6.0.0-alpha.2. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided in the source data.
Vite development server allows unauthorized file disclosure by bypassing server.fs.deny restrictions when specific query parameters (?raw, ?import&raw, ?import&url&inline) are appended to file requests. The npm package 'vite' is affected when the dev server is explicitly exposed to the network and sensitive files exist within allowed directories but are supposedly blocked by deny patterns. A publicly available exploit code exists demonstrating retrieval of .env files and certificates. Fixed in versions 7.3.2 and 8.0.5 according to vendor release tags.
A signature bypass in n8n's waiting-webhook endpoint allows attackers who possess a valid resume token for an existing Send-and-Wait execution to approve waiting executions intended for other users, causing downstream workflow actions to run under the workflow owner's credentials, which may include command execution if the workflow is configured to perform such actions. Affects n8n versions before 2.41.4 and 2.42.x before 2.42.1. No public exploit identified at time of analysis; exploitation requires a valid resume token (no authentication to n8n itself is needed beyond the token), and the impact is bounded by the target workflow's downstream nodes. This is a moderate-to-high priority issue for organizations running n8n, but not a drop-everything emergency.
OS command injection in PeaZip before 11.3.0 allows an attacker to run arbitrary commands on a victim's machine by embedding a specially crafted filename in an archive, provided PeaZip is running in a specific non-default configuration. The root cause is mishandling of the 'quotation character already used in the string' condition, which lets the injected filename escape the application's quoting and reach the shell; the CVSS 4.0 vector records no required privileges (PR:N) but explicitly captures attack prerequisites (AT:P), and exploitation is local with user interaction, meaning the victim must open or process the malicious archive. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor has addressed it in PeaZip 11.3.0, and the independent assessment rates this moderate priority - worth patching, but not an emergency.
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
Host confusion in GuzzleHttp Guzzle before 7.15.2 and 8.0.1 allows remote attackers who can influence a fetched URI to bypass application-level host validation and reach network hosts the application intended to block, including loopback and internal addresses. The divergence occurs because PHP's filter_var() and Guzzle's own host checks operate on the literal URI text while libcurl independently percent-decodes and IDNA-maps the authority before resolving and connecting, meaning the application and transport disagree on which host is being contacted. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but any application that implements SSRF mitigations via URI host inspection before passing a user-supplied URL to Guzzle is directly undermined.
WAF filtering bypass in OWASP ModSecurity (libmodsecurity) before 3.0.16 lets remote unauthenticated attackers smuggle malicious payloads past inspection rules by exploiting a multipart/form-data parser differential. The engine silently strips embedded line breaks from non-file form-field values before populating ARGS and ARGS_POST, so any rule whose detection depends on a newline (e.g. command, header, or injection syntax spanning a line break) fails to match while the backend still receives and acts on the intact payload. No public exploit identified at time of analysis, but the CVSS base score of 8.6 reflects a scope-changing integrity impact on every application shielded by an affected deployment.
Command-execution permission bypass in Warp's default unsandboxed CLI agent profile (versions 0.2025.10.08.08.12.stable_00 through the fix in 0.2026.05.06.15.42.stable_01) lets denylisted, confirmation-required commands auto-execute. Because the non-interactive CLI agent matched command strings against its denylist before stripping leading environment-variable assignments, an attacker able to influence the agent's emitted command output (e.g., via prompt injection) can prefix a blocked command such as 'rm' with 'X=1' to evade the safety boundary. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Linked Data Signature forgery in Fedify (the @fedify/fedify ActivityPub server framework) before 2.2.3 lets remote unauthenticated attackers reshape a third-party-signed activity so it is interpreted differently while its signature still verifies. Because the signature covers the canonical RDF graph rather than the JSON-LD serialization, an attacker who has received a signed activity can use JSON-LD keywords (@graph, @reverse, @included) or context-alias tricks to promote, hide, or rewrite fields and have the forged result accepted as authentic. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the GitHub Security Advisory documents the exact restructuring techniques in detail.
Commit and tag signature confusion in go-git (the pure-Go implementation of Git) lets a crafted Git object carry a signature that validates while its effective metadata differs from what was actually signed. Because go-git parses ambiguous or malformed object headers differently from canonical Git, and because its signing/verification path operates over a reconstructed representation rather than the raw object bytes, an attacker with contributor access can create commits whose displayed author/committer/metadata diverges from the signed payload - undermining downstream trust decisions (the issue was originally surfaced through sigstore/gitsign). Affected releases are go-git v5 before 5.19.0 and v6 alpha builds 6.0.0-alpha.1 through 6.0.0-alpha.2. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided in the source data.
Vite development server allows unauthorized file disclosure by bypassing server.fs.deny restrictions when specific query parameters (?raw, ?import&raw, ?import&url&inline) are appended to file requests. The npm package 'vite' is affected when the dev server is explicitly exposed to the network and sensitive files exist within allowed directories but are supposedly blocked by deny patterns. A publicly available exploit code exists demonstrating retrieval of .env files and certificates. Fixed in versions 7.3.2 and 8.0.5 according to vendor release tags.