The Leader in Cloud Security Research

A stylized graphic of a robotic control system with alert icons and 'Instance Takeover' superimposed on top of it

Critical unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) allows full instance takeover

A critical vulnerability (CVE-2026-21858, CVSS score 10.0) was disclosed affecting the n8n workflow automation platform, allowing attackers to remotely execute code and fully take over vulnerable instances without any authentication. Due to the potential for complete compromise of automation infrastructure, data exposure, and downstream access to integrated systems, immediate patching is required. The issue originates …

January 07, 2026
By Roi Nisimi

Latest

All Latest

Discovered Vulnerabilities

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

This week, three new high-severity vulnerabilities were revealed in runC, the fundamental runtime technology used by most container platforms. This impacts major systems such as Docker, containerd, Kubernetes, and virtually all managed Kubernetes services offered by major cloud providers. These vulnerabilities combined allow for a container escape, where a malicious factor can break out of …

November 10, 2025
By Shir Sadon

A stylized graphic of the word CVE Alert next to a broken cog

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

October 26, 2025

A stylized graphic of a pull request from GitHub with a hole in it and data leaking out

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

September 30, 2025

A stylized graphic showing a pull request window with malicious code

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

September 24, 2025

A stylized graphic of floating packages in a dark cloud background

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

September 16, 2025

All Discovered Vulnerabilities

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk

Get the report

Critical unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) allows full instance takeover

Latest

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

Explore

Discovered Vulnerabilities

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

‘Orca Watch’ Series

Critical unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) allows full instance takeover

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

Technical Deep Dives

Watch the Typo: Our PoC Exploit for Typosquatting in GitHub Actions

Kubernetes Testing Environment: An Open Source Resilience Platform for EKS, GKE and AKS

Meet AI Goat: The First Open Source AI Security Learning Environment Based on the OWASP Top 10 ML Risks

The Five Most Common AI Model Risks and How to Prevent Them

Leveraging Nuclei Templates to Identify Risks and Threats in Critical Cloud Applications

Thought Leadership

Where to Start Your Cloud Security Program: CSPM, CWPP, or Runtime Data? A Modern Guide to CNAPP Maturity

The Cloud's Year-End Confessions: What Really Happened in 2025

OWASP Top 10 2025: Key Changes and What They Mean for Application Security

Part 2: Attackers Love Your GitHub Actions Too

Part 1: Attackers Love Your GitHub Actions Too

In the News

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk

Featured

Critical unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) allows full instance takeover

Latest

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

Discovered Vulnerabilities

New runC Vulnerabilities Expose Docker and Kubernetes to Container Escape Attacks

CVE-2025-59287 Explained: Critical WSUS RCE Vulnerability Actively Exploited

pull_request_nightmare Part 2: Exploiting GitHub Actions for RCE and Supply Chain

pull_request_nightmare Part 1: Exploiting GitHub Actions for RCE and Supply Chain Attacks

Massive npm Malware Campaign Infects Popular Packages, @ctrl/tinycolor Affected

‘Orca Watch’ Series

Critical unauthenticated RCE in n8n (CVE-2026-21858, CVSS 10.0) allows full instance takeover

Critical 9.3 Severity LangChain Serialization Flaw Enables Secret Theft

Critical Unauthenticated MongoDB Heap Memory Leak Vulnerability Leaks Sensitive Data

Critical n8n RCE vulnerability enables full server compromise

Additional React and Next.js RSC Vulnerabilities Lead to Denial-of-Service and Source Code Disclosure

Technical Deep Dives

Watch the Typo: Our PoC Exploit for Typosquatting in GitHub Actions

Kubernetes Testing Environment: An Open Source Resilience Platform for EKS, GKE and AKS

Meet AI Goat: The First Open Source AI Security Learning Environment Based on the OWASP Top 10 ML Risks

The Five Most Common AI Model Risks and How to Prevent Them

Leveraging Nuclei Templates to Identify Risks and Threats in Critical Cloud Applications

Thought Leadership

Where to Start Your Cloud Security Program: CSPM, CWPP, or Runtime Data? A Modern Guide to CNAPP Maturity

The Cloud's Year-End Confessions: What Really Happened in 2025

OWASP Top 10 2025: Key Changes and What They Mean for Application Security

Part 2: Attackers Love Your GitHub Actions Too

Part 1: Attackers Love Your GitHub Actions Too

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2025 State of Cloud Security Report: Hunting threats in the age of relentless risk