Security Advisories

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Electron: AppleScript injection in app.moveToApplicationsFolder on macOS

Electron: Service worker can spoof executeJavaScript IPC replies

Electron: Incorrect origin passed to permission request handler for iframe requests

Electron: Out-of-bounds read in second-instance IPC on macOS and Linux

Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Electron: Use-after-free in offscreen child window paint callback

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Electron: Use-after-free in download save dialog callback

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Electron: Use-after-free in PowerMonitor on Windows and macOS

Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

Electron: USB device selection not validated against filtered device list

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

FastMCP has a Command Injection vulnerability - Gemini CLI

FastMCP has a Command Injection vulnerability - Gemini CLI

FastMCP has a Command Injection vulnerability - Gemini CLI

n8n has XSS in its Credential Management Flow

n8n has XSS in Chat Trigger Node through Custom CSS

n8n: Authenticated XSS and Open Redirect via Form Node

n8n has a Stored XSS Vulnerability in its Form Trigger

n8n Vulnerable to LDAP Filter Injection in LDAP Node

n8n Vulnerable to XSS via Binary Data Inline HTML Rendering

n8n has SQL Injection in Data Table Node via orderByColumn Expression

n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE

n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no

n8n Has External Secrets Authorization Bypass in Credential Saving

n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover

n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

n8n has In-Process Memory Disclosure in its Task Runner

AWS API MCP File Access Restriction Bypass

FastMCP OAuth Proxy token reuse across MCP servers

FastMCP OAuth Proxy token reuse across MCP servers

FastMCP OAuth Proxy token reuse across MCP servers

mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft

mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

n8n has Webhook Forgery on Zendesk Trigger Node

n8n has a Guardrail Node Bypass

n8n has an Authentication Bypass in its Chat Trigger Node

n8n has an SSO Enforcement Bypass in its Self-Service Settings API

n8n: Webhook Forgery on Github Webhook Trigger