Chat Hub: chat-only users can register tool types the product already tries to sandbox GHSA-43v8-hjhm-chjp published Oct 14, 2026 by CharlieKolb Moderate
OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes GHSA-mgpr-56r4-5c67 published Oct 14, 2026 by CharlieKolb Moderate
Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value GHSA-8vrr-mgc5-jg55 published Oct 14, 2026 by CharlieKolb Moderate
Credential Secrets Exposed in Execution Error Data of Several Nodes GHSA-qmvv-q3c9-wpp7 published Oct 14, 2026 by CharlieKolb Moderate
Per-User Credential Theft via Error-Workflow Execution Context Inheritance GHSA-pcr3-v5vr-qppf published Oct 14, 2026 by CharlieKolb Moderate
Quick Base Node Allows Filter Injection Through the Where Parameter GHSA-65mv-v8rp-54wc published Oct 14, 2026 by CharlieKolb Moderate
Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block GHSA-m7gv-mpg5-7c9v published Oct 14, 2026 by CharlieKolb High
SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data GHSA-crfj-5wv6-8v86 published Oct 14, 2026 by CharlieKolb Moderate
Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting GHSA-mp7q-23hg-35cf published Oct 14, 2026 by CharlieKolb High
Crafted Workflow ID Gives Access to Data Tables in Other Projects GHSA-wvjj-qg37-pv73 published Oct 14, 2026 by CharlieKolb High
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
