CVE-2026-81533

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-19002

Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-18888

MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-66016

Rendered Artifactory Helm manifests may contain generated TLS private keys

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-69105

Potential package cache integrity issue in JFrog Artifactory

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-69107

Potential unauthorized artifact access in JFrog Artifactory

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-70547

Potential unauthorized metadata exposure in JFrog Artifactory

An authenticated user without repository read permission may access package metadata under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-76240

stigmem Postgres SQL Injection via Schema Identifier

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-76245

stigmem Federation Peer Token Timestamp Validation Bypass

stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-76242

stigmem Federation Peer Registration Authentication Bypass

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-82468

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jeremyevans

Products

Rodauth

CVE-2026-89066

OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Projen

CVE-2026-16033

Arbitrary file read+write on host via templates/ symlink in malicious image

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Lxd

CVE-2026-86080

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-86079

n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-86078

n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain __proto__ or constructor, causing nested writes to reach Object.prototype in the main n8n process and disrupt later requests. The affected function is summarizeWorkflowStructure in packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts. This issue is fixed in versions 2.37.7 and 2.38.2.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-86076

n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution. The affected AST hook is PrototypeSanitizer in packages/workflow/src/expression-sandboxing.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-86075

n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage. The affected validation is in packages/cli/src/modules/oauth-server/oauth-server.service.ts, including MAX_CLIENT_NAME_LENGTH and MAX_GRANT_TYPES. This issue is fixed in versions 2.37.7 and 2.38.2.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-86074

n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verification URL without checking that it matched the workflow node's origin. Attacker-controlled fetched content could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. The affected logic includes packages/@n8n/instance-ai/src/tools/workflows/credential-utils.ts and the extractServiceOrigin origin derivation. This issue is fixed in versions 2.37.7 and 2.38.2.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-78127

Memory Leak in StrongSwan's IKE Message Parser

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Strongswan

Products

Strongswan