A workflow automation platform that allows users to create, automate, and integrate workflows between different services and applications through a visual interface, supporting both cloud-hosted and self-hosted deployments.

n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.

CVE-2025-68613

GitHub Advisory Database

MongoDB is a general-purpose, document-based, distributed database built for modern application developers and for the cloud era.

MongoDB

Rsync is a utility for efficiently transferring and synchronizing files between a computer and an external hard drive, and across networked computers by comparing the modification times and sizes of files.

rsync

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

CVE-2025-14847

Ubuntu

Linux Ubuntu

Ubuntu Security Tracker

Linux

Linux Kernel

Windows

Windows Cumulative Update

VulnCheck NVD++

A cloud-native network security solution that provides enterprise-grade security features including firewall, IPS, antivirus, and VPN capabilities for cloud environments. WatchGuard Firebox Cloud is designed to protect workloads running in public cloud platforms like AWS and Azure, offering unified security management and policy enforcement across hybrid infrastructures.

WatchGuard Firebox

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.

CVE-2025-14733

SonicWall SMA 8200v Appliance is a secure remote access solution that provides employees and partners with policy-enforced access to critical network resources. It offers SSL VPN connectivity for both managed and unmanaged devices, supporting a wide range of operating systems and browsers.

SonicWall SMA 8200v Appliance

A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

CVE-2025-40602

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

Grafana is an open-source visualization and analytics software. It allows you to query, visualize, alert on, and explore your metrics and time-series database (TSDB) data.

Grafana

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.

CVE-2025-68429

Red Hat

Red Hat Errata

PHP is a general-purpose scripting language that is especially suited for web development.

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Fedora is a popular open-source, Linux-based operating system.

Linux Fedora

Alpine Linux is a Linux distribution based on musl and BusyBox, designed for security, simplicity, and resource efficiency.

Linux Alpine

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

Echo

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

CVE-2025-14180

Alpine

Alpine Security Tracker

Debian

Debian Security Tracker

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

CVE-2025-14178

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.

CVE-2025-14177

Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.

CVE-2025-68927

GoLang

Espressif ESP-IDF Tools is a suite of software tools used for the development of applications for Espressif Systems' ESP32, ESP32-S, and ESP32-C series of SoCs. It includes build tools, a compiler, OpenOCD and ESP-IDF Tools Installer. The tools facilitate the setup of environments, building, flashing, monitoring, and other tasks required for ESP-IDF development on a variety of operating systems.

Espressif ESP-IDF Tools

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earlier, in the avrc_vendor_msg() function of the ESP-IDF BlueDroid AVRCP stack, the allocated buffer size was validated using AVRC_MIN_CMD_LEN (20 bytes). However, the actual fixed header data written before the vendor payload exceeds this value. This totals 29 bytes written before p_msg->p_vendor_data is copied. Using the old AVRC_MIN_CMD_LEN could allow an out-of-bounds write if vendor_len approaches the buffer limit. For commands where vendor_len is large, the original buffer allocation may be insufficient, causing writes beyond the allocated memory. This can lead to memory corruption, crashes, or other undefined behavior. The overflow could be larger when assertions are disabled.

CVE 識別子	重大度	スコア	テクノロジー	コンポーネント名	CISA KEV エクスプロイト	修正あり	公開日
CVE-2025-68613	CRITICAL	9.9	n8n	n8n	いいえ	はい	Dec 19, 2025
CVE-2025-14847	HIGH	8.7	MongoDB	cpe:2.3:a:mongodb:mongodb	いいえ	はい	Dec 19, 2025
CVE-2025-14733	CRITICAL	9.3	WatchGuard Firebox	cpe:2.3:o:watchguard:fireware	はい	はい	Dec 19, 2025
CVE-2025-40602	MEDIUM	6.6	SonicWall SMA 8200v Appliance	cpe:2.3:a:sonicwall:sma8200v	はい	はい	Dec 18, 2025
CVE-2025-68429	HIGH	7.3	JavaScript	grafana-selinux	いいえ	はい	Dec 17, 2025

CVE 識別子	重大度	スコア	テクノロジー	コンポーネント名	CISA KEV エクスプロイト	修正あり	公開日
CVE-2025-14180	HIGH	8.2	PHP	php-cli	いいえ	はい	Dec 27, 2025
CVE-2025-14178	MEDIUM	6.5	PHP	php-common-debuginfo	いいえ	はい	Dec 27, 2025
CVE-2025-14177	MEDIUM	6.3	PHP	php-common-debuginfo	いいえ	はい	Dec 27, 2025
CVE-2025-68927	HIGH	7.3	該当なし	github.com/abhinavxd/libredesk	いいえ	はい	Dec 27, 2025
CVE-2025-68474	MEDIUM	6.1	Espressif ESP-IDF Tools	cpe:2.3:a:espressif:esp-idf	いいえ	はい	Dec 27, 2025

Wiz脆弱性データベース

テクノロジーで探す

人気のフィルター

ハイプロファイル

最新

数字で見る脆弱性

良いこと、悪いこと、そして弱者

Wizのその他のリソース

Cloud Vulnerability DB

PEACH

実際に Wiz を見てみませんか？