CVE Vulnerability Catalog

Incomplete cleanup in the Browser component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Severity: Medium)

Information leak vulnerability in the ControlledFrame component in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could obtain sensitive information via a crafted HTML page.

Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could spoof UI elements via a crafted HTML page.

Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass system access restrictions via a crafted HTML page.

MCP Kotlin SDK versions 0.7.0 through 0.12.0 have an unbounded buffer growth in the ReadBuffer.append function, allowing a remote attacker to exhaust memory (OOM) and crash the process. The issue occurs in the stdio transport where data is buffered without a size limit.

Sylius, an open-source eCommerce framework on Symfony, contains a vulnerability in versions from 2.0.0 to 2.0.17, 2.1.14, and 2.2.5. The GET and PUT API endpoints for payment requests do not verify resource ownership based on the hash, allowing an attacker to read payment and order data and modify redirect fields. A similar issue affects payment creation, where order ownership is not checked.

Sylius, an Open Source eCommerce Framework on Symfony, contains an authorization bypass vulnerability in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint does not validate that the chosen payment method is enabled for the order's channel, allowing an authenticated customer to assign any globally enabled payment method to their order, including methods excluded by the store operator.

Sylius, an Open Source eCommerce Framework on Symfony, contains an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order's changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order.

The source-controller, a Kubernetes operator for acquiring artifacts from external sources, contains a vulnerability in versions 0.0.17 through 1.8.4. An actor able to influence bucket contents can cause writes outside the working directory, and a user with permissions to create/update GitRepository resources can enumerate file paths on the controller pod (only in v1.6.0+).

A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory.

n8n, an open source workflow automation platform, prior to versions 2.37.7 and 2.38.2 did not enforce the workflow setting 'This workflow can be called by' when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data.

n8n, an open source workflow automation platform, prior to versions 1.123.76, 2.37.7, and 2.38.2 had a vulnerability in the Git node. The setUpstream function wrote a branch..remote value into repository configuration without validation, and a later fetch or pull used that configuration instead of the checked parameter. An authenticated workflow editor could point Git at any local repository readable by the n8n process and receive its contents.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, the /rest/active-workflows endpoint returned every active workflow ID to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint.

Prior to versions 2.37.7 and 2.38.2 of n8n, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints checked only whether the caller could manage the role type. A caller with role:manageProject could name a project the caller could not list and obtain member names and email addresses.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions.

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret.

Prior to versions 1.123.76, 2.37.7, and 2.38.2 of n8n, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential.

Prior to versions 2.37.7 and 2.38.2 of n8n, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests.