CVE Vulnerability Catalog

Gearsystem's optional --mcp-http mode accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation. The socket binds INADDR_ANY (usually port 7777), and POST /mcp requests reach dispatch without Authorization, Host, or Origin checks.

In KServe, a namespace-scoped user with create/update permissions on InferenceService resources can supply a malicious storageUri. This SSRF vulnerability lets the storage-initializer init container issue arbitrary outbound HTTP/HTTPS requests from inside the cluster.

In the Echo Go web framework before 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from the router. The router matches the still-encoded path while the static handler uses the decoded URL.Path, potentially exposing files.

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in its openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file and skip standard permission checks.

WSO2 Products have an improper implementation of access control rules, allowing malicious actors to perform a Server Side Request Forgery (SSRF) attack. Exploitation allows access to both internal and external resources available through the network or filesystem.

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a relative symlink such as "up/" to move host directories into its sandbox and read or write them.

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow construction when a victim loads or runs the bundle.

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook. When no signing secret is set, an unauthenticated attacker can bypass signature verification and cause the workspace access token to be sent to an attacker-controlled host.

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability. Low-privileged users can save workflows with specially named connection keys such as __proto__, causing logins and writes to fail with server errors.

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability. Member users can use credentials they cannot access by omitting default node parameters, causing decrypted credential values to be sent to attacker-chosen destinations.

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability. Editors of shared workflows can use restricted credentials by loading sub-workflows from URLs or local files, allowing decrypted project credential values to be obtained.

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID. A crafted ID such as __proto__ makes the Data Table project check match every project, allowing an authenticated member to list, read, modify, and delete Data Table rows in all projects of the instance.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability. Some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy, allowing authenticated members to serve HTML that runs on the n8n origin.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as webhook data used to build the filter can make Get Many return every record or Delete remove every record with the workflow credential's privileges.

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox's entire contact list or redirect SharePoint writes onto unintended list items within the stored credential's scope.