Security advisories

high2026-02-04

CVE-2026-25055-n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node

n8n-io/n8n · GHSA-m82q-59gv-mcr9

high2026-02-04

CVE-2026-25054-n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI

n8n-io/n8n · GHSA-qpq4-pw7f-pp8w

medium2026-02-04

CVE-2026-25475-OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction

openclaw/openclaw · GHSA-r8g4-86fx-92mq

high2026-02-04

CVE-2026-25161-Alist vulnerable to Path Traversal in multiple file operation handlers

alistgo/alist · GHSA-x4q4-7phh-42j9

critical2026-02-04

CVE-2026-25160-Alist has Insecure TLS Config

alistgo/alist · GHSA-8jmm-3xwx-w974

critical2026-02-04

CVE-2026-25053-n8n has OS Command Injection in Git Node

n8n-io/n8n · GHSA-9g95-qf3f-ggrw

critical2026-02-04

CVE-2026-25052-n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users

n8n-io/n8n · GHSA-gfvg-qv54-r4pc

high2026-02-04

CVE-2026-25051-n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS

n8n-io/n8n · GHSA-825q-w924-xhgx

critical2026-02-04

CVE-2026-25049-n8n Has Expression Escape Vulnerability Leading to RCE

n8n-io/n8n · GHSA-6cqr-8cfr-67f8

high2026-02-04

CVE-2026-23897-Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`

apollographql/apollo-server · GHSA-mp6q-xf9x-fwf7

critical2026-02-04

CVE-2026-21893-n8n Vulnerable to Command Injection in Community Package Installation

n8n-io/n8n · GHSA-7c4h-vh2m-743m

high2026-02-04

CVE-2025-61917-n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner

n8n-io/n8n · GHSA-49mx-fj45-q3p6

medium2026-02-04

CVE-2026-24735-Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability

apache/answer · GHSA-5w5r-8xc6-2xhw

medium2026-02-04

CVE-2026-1622-Neo4j Enterprise and Community vulnerable to a potential information disclosure

neo4j/neo4j · GHSA-4j3g-rwwq-4p54

high2026-02-04

CVE-2026-24512-ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx

kubernetes/ingress-nginx · GHSA-jx8c-56mg-h6vp

high2026-02-04

CVE-2026-1580-ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

kubernetes/ingress-nginx · GHSA-9h3p-52vh-959w

low2026-02-04

CVE-2026-24513-ingress-nginx has Improper Check for Unusual or Exceptional Conditions

kubernetes/ingress-nginx · GHSA-4g2f-xcph-2335

medium2026-02-04

CVE-2026-24514-ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling

kubernetes/ingress-nginx · GHSA-2pf9-vr92-6h3v

critical2026-02-04

CVE-2026-25579-Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints

navidrome/navidrome · GHSA-hrr4-3wgr-68x3

medium2026-02-04

CVE-2026-25578-Navidrome has XSS via comment from song metadata

navidrome/navidrome · GHSA-rh3r-8pxm-hg4w