Monthly
n8n workflow automation instances older than 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 let an authenticated user with workflow-authoring rights escape the task runner isolation that normally constrains custom code. By creating, editing, or importing a workflow that names one of the deprecated hidden node types (Function, Function Item, or LangChain Code), that user can execute arbitrary JavaScript inside the n8n main process rather than in the sandboxed runner, giving full compromise of the application host process. Severity is high (CVSS 8.7, CWE-653) but exploitation requires a valid account plus workflow-authoring permission; no confirmed public exploit code has been identified at time of analysis, and vendor patches are available for all three branches, with the priority assessed as this week rather than an emergency.
Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attackers to forge magic-link tokens and log in as any email address when the default MAGIC_LINK_SECRET from hosting/docker/.env.example is still in use. Publicly available exploit code exists; successful exploitation can expose or modify tenant data, and may escalate to full infrastructure compromise because default Postgres, Redis, and ClickHouse credentials are reachable from runner containers on the same Docker network. The issue is limited to Docker Compose deployments that never rotated the example secrets and left WHITELISTED_EMAILS unset; the hosted SaaS and instances with regenerated secrets or an email allowlist are not affected.
Authenticated remote code execution in JoySafeter through 1.0.0 allows any self-registered low-privilege user to run host operating-system commands by selecting Copilot standard mode and invoking its unsandboxed execute tool over the WebSocket chat.start extension. Successful exploitation can expose other tenants' data and server secrets because the agent calls subprocess.run with shell=True outside a sandbox, and publicly available exploit code exists. The assessed CVSS 3.1 vector requires only PR:L with no user interaction, so internet-facing deployments that allow open registration are directly exposed and warrant operational priority.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing inside the conversion sandbox to break confinement and act with the privileges of the application service account, enabling reads or modifications of application data and configuration or disruption of the service. Exploitation is conditional: the attacker must first get code running inside the sandbox, typically by submitting a crafted document for conversion, and the CVSS vector (AV:L/PR:L/UI:N/S:C) confirms a local, low-privilege prerequisite with no user interaction once that foothold exists. No public exploit code has been identified at time of analysis, making this a genuine but conditional integrity and availability risk rather than a mass-exploitation threat; a vendor-released patch is documented in Kiteworks advisory GHSA-58j2-hj9r-c258.
MrSteam iSteamX mobile app and hub users can have their device telemetry and control exposed because the pre-9/18/2026 AWS IoT policy allowed any authenticated app user to subscribe and publish to wildcard MQTT topics. An attacker with a valid iSteamX account and knowledge of the topic namespace can read other users' profile/device data, start or stop connected steam devices, and potentially cause scalding through unintended activation. The flaw requires low-privilege authentication (PR:L) and no victim interaction; it was remediated server-side before 9/18/2026, and no public exploit identified at time of analysis.
The npm package praisonai exposes a SandboxExecutor 'network-isolated' mode that is advertised to users as 'No network access (proxy blocked)' but only injects http_proxy/https_proxy=http://localhost:0 without creating any operating-system network boundary, so sandboxed commands that ignore proxy environment variables can still open sockets directly. Versions 1.2.3 through 1.7.1 of the npm package are affected; an initial fix shipped in 1.7.2. A local-only proof-of-concept is described in the vendor advisory (a plain Node HTTP client reaches a loopback server while a proxy
Privilege escalation via dynamic client registration in malach-it's Boruta OAuth 2.0/OpenID Connect provider library (Elixir) lets an unauthenticated registrant create OIDC clients that carry administrative security attributes. Because Boruta.Openid.register_client/3 forwards caller-supplied parameters straight into the administrative client-creation changeset with no public/admin allowlist, a self-registering client can dictate its own supported grant types, authorized scopes, PKCE enforcement, public refresh/revocation behavior, token lifetimes, and signing settings on versions 2.3.0 through 2.3.6. There is no public exploit identified at time of analysis and it is not in CISA KEV, but a vendor-released patch (2.3.7) is available.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.
n8n workflow automation instances older than 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 let an authenticated user with workflow-authoring rights escape the task runner isolation that normally constrains custom code. By creating, editing, or importing a workflow that names one of the deprecated hidden node types (Function, Function Item, or LangChain Code), that user can execute arbitrary JavaScript inside the n8n main process rather than in the sandboxed runner, giving full compromise of the application host process. Severity is high (CVSS 8.7, CWE-653) but exploitation requires a valid account plus workflow-authoring permission; no confirmed public exploit code has been identified at time of analysis, and vendor patches are available for all three branches, with the priority assessed as this week rather than an emergency.
Authentication bypass in Trigger.dev self-hosted v4 deployments (npm trigger.dev <=4.5.5) allows unauthenticated attackers to forge magic-link tokens and log in as any email address when the default MAGIC_LINK_SECRET from hosting/docker/.env.example is still in use. Publicly available exploit code exists; successful exploitation can expose or modify tenant data, and may escalate to full infrastructure compromise because default Postgres, Redis, and ClickHouse credentials are reachable from runner containers on the same Docker network. The issue is limited to Docker Compose deployments that never rotated the example secrets and left WHITELISTED_EMAILS unset; the hosted SaaS and instances with regenerated secrets or an email allowlist are not affected.
Authenticated remote code execution in JoySafeter through 1.0.0 allows any self-registered low-privilege user to run host operating-system commands by selecting Copilot standard mode and invoking its unsandboxed execute tool over the WebSocket chat.start extension. Successful exploitation can expose other tenants' data and server secrets because the agent calls subprocess.run with shell=True outside a sandbox, and publicly available exploit code exists. The assessed CVSS 3.1 vector requires only PR:L with no user interaction, so internet-facing deployments that allow open registration are directly exposed and warrant operational priority.
QNAP Notes Station 3 versions prior to 3.9.11 fail to properly compartmentalize privileged functionality, so an attacker who already holds a local administrator account on the NAS can step outside the intended isolation boundary and compromise the confidentiality, integrity, and availability of the system. The vulnerability is strictly local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), meaning it is not remotely reachable and cannot be triggered by an unauthenticated or low-privileged user; realistic abuse is limited to malicious privileged insiders or privilege/isolation escape following an earlier compromise. QNAP has released a fix in Notes Station 3 3.9.11 and later, and there is no public exploit code or CISA KEV entry identified at time of analysis, so this is a moderate-priority, high-barrier issue rather than an urgent widespread threat.
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing inside the conversion sandbox to break confinement and act with the privileges of the application service account, enabling reads or modifications of application data and configuration or disruption of the service. Exploitation is conditional: the attacker must first get code running inside the sandbox, typically by submitting a crafted document for conversion, and the CVSS vector (AV:L/PR:L/UI:N/S:C) confirms a local, low-privilege prerequisite with no user interaction once that foothold exists. No public exploit code has been identified at time of analysis, making this a genuine but conditional integrity and availability risk rather than a mass-exploitation threat; a vendor-released patch is documented in Kiteworks advisory GHSA-58j2-hj9r-c258.
MrSteam iSteamX mobile app and hub users can have their device telemetry and control exposed because the pre-9/18/2026 AWS IoT policy allowed any authenticated app user to subscribe and publish to wildcard MQTT topics. An attacker with a valid iSteamX account and knowledge of the topic namespace can read other users' profile/device data, start or stop connected steam devices, and potentially cause scalding through unintended activation. The flaw requires low-privilege authentication (PR:L) and no victim interaction; it was remediated server-side before 9/18/2026, and no public exploit identified at time of analysis.
The npm package praisonai exposes a SandboxExecutor 'network-isolated' mode that is advertised to users as 'No network access (proxy blocked)' but only injects http_proxy/https_proxy=http://localhost:0 without creating any operating-system network boundary, so sandboxed commands that ignore proxy environment variables can still open sockets directly. Versions 1.2.3 through 1.7.1 of the npm package are affected; an initial fix shipped in 1.7.2. A local-only proof-of-concept is described in the vendor advisory (a plain Node HTTP client reaches a loopback server while a proxy
Privilege escalation via dynamic client registration in malach-it's Boruta OAuth 2.0/OpenID Connect provider library (Elixir) lets an unauthenticated registrant create OIDC clients that carry administrative security attributes. Because Boruta.Openid.register_client/3 forwards caller-supplied parameters straight into the administrative client-creation changeset with no public/admin allowlist, a self-registering client can dictate its own supported grant types, authorized scopes, PKCE enforcement, public refresh/revocation behavior, token lifetimes, and signing settings on versions 2.3.0 through 2.3.6. There is no public exploit identified at time of analysis and it is not in CISA KEV, but a vendor-released patch (2.3.7) is available.
Remote code execution in Apache Syncope's connector subsystem allows an administrator holding sufficient entitlements to run arbitrary Groovy scripts through scripted REST and SQL connectors, escaping the intended sandbox and executing code on the host. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1, and is rooted in improper isolation (CWE-653) of the scripting engine. Although the published CVSS is 9.8, the vendor description states an authenticated privileged administrator is required, and there is no public exploit identified at time of analysis.
Remote code execution in Apache Syncope's workflow engine lets an administrator holding sufficient entitlements run arbitrary Groovy code on the server by importing and starting a malicious BPMN process definition through the REST API. Because Flowable's Groovy scriptTasks execute with no sandbox in affected 3.0.x, 4.0.x, and 4.1.x releases, script code embedded in the process runs directly with the privileges of the Syncope core JVM. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial exploitation path once an entitled admin account is reached makes it a strong candidate for post-compromise abuse and insider misuse.