n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
Affects: n8n
Advisories
Security advisories for popular AI software, newest first, each linked to its public source.
282 advisories rated Medium
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
Affects: n8n
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
Affects: n8n
Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery…
Affects: Langflow
vLLM: Processing differential in multi-channel audio downmixing enables hidden-input/moderation bypass…
Affects: vLLM
n8n: External Secrets Permission Bypass via Expression Parser Mismatch
Affects: n8n
n8n: N8n contains an authentication bypass in the Chat Trigger node when configured with n8n User…
Affects: n8n
Keras: Tar extraction permits symlink-based path traversal
Affects: Keras
n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads
Affects: n8n
n8n: N8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site…
Affects: n8n
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update…
Affects: Open WebUI
Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation…
Affects: Open WebUI
Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation
Affects: Open WebUI
Open WebUI: Arena task endpoints can bypass underlying model access controls
Affects: Open WebUI
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary…
Affects: Open WebUI
Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials
Affects: Open WebUI
Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default config
Affects: Open WebUI
Open WebUI: Account enumeration via observable login timing discrepancy
Affects: Open WebUI
Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users…
Affects: Open WebUI
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs…
Affects: Open WebUI
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Affects: Open WebUI
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
Affects: n8n
n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
Affects: n8n
n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
Affects: n8n
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Affects: LiteLLM
LiteLLM: Local file read via request-supplied OIDC file references
Affects: LiteLLM
n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other…
Affects: n8n
n8n: N8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API…
Affects: n8n
n8n: N8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three…
Affects: n8n
n8n: N8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk…
Affects: n8n
n8n: N8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow…
Affects: n8n
Open WebUI: Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
Affects: Open WebUI
Open WebUI: Open WebUI allows limited stored XSS vila uploaded html file
Affects: Open WebUI
vLLM: vLLM denial of service via prompt embeds on M-RoPE models
Affects: vLLM
vLLM: Speech-to-text upload size limit is enforced after full UploadFile read
Affects: vLLM
Keras: HDF5 virtual datasets can disclose local files
Affects: Keras
n8n: N8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security…
Affects: n8n
n8n: N8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS…
Affects: n8n
Flowise: Flowise before 3.1.2 sets Access-Control-Allow-Origin to a hardcoded wildcard (*) on its…
Affects: Flowise
Langflow: IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability…
Affects: Langflow
Flowise: Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a…
Affects: Flowise
n8n: N8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0…
Affects: n8n
Flowise: Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations…
Affects: Flowise
Flowise: Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded…
Affects: Flowise
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Affects: Open WebUI
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path…
Affects: Open WebUI
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Affects: Open WebUI
Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Affects: Open WebUI
Open WebUI: Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Affects: Open WebUI
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
Affects: Open WebUI