What you need to know today.
Critical RCE vulnerabilities in n8n and GitLab, alongside numerous flaws in SAP and networking devices, dominate today's security brief.
A critical remote code execution (RCE) vulnerability in n8n's workflow expression evaluation system has been added to the Known Exploited Vulnerabilities (KEV) catalog. This flaw, affecting versions prior to 1.120.4, 1.121.1, and 1.122.0, allows unauthenticated attackers to execute arbitrary code. The vulnerability was highlighted in discussions around AI-powered autonomous cyberattacks, with reports indicating its potential use in exploiting live instances via leaked API tokens. Patches are available in newer versions of n8n. CVE-2025-68613.
GitLab has released emergency patches for a critical RCE vulnerability affecting all versions prior to 19.2.8, 19.3.5, and 19.4.2. This flaw, identified as CVE-2026-97229, could allow unauthenticated users to execute arbitrary code on GitLab instances under specific conditions. Security researchers and CISA have urged administrators to apply the updates immediately due to the critical nature of the vulnerability. The issue stems from an improper handling of regular expressions within the CI/CD functionality.
Multiple critical vulnerabilities have been disclosed across SAP products, including a CVSS 10.0 OAuth2 SSRF flaw in the SAP Cloud SDK for Python (CVE-2026-89111) that could lead to credential theft. Additionally, SAP NetWeaver Visual Composer (CVE-2026-89110) and SAP S/4HANA (CVE-2026-89107) have vulnerabilities that could allow privilege escalation or code execution. These flaws underscore the need for prompt patching of SAP environments to prevent potential compromise.
Critical vulnerabilities have been disclosed in Progress MarkLogic Server, with two flaws (CVE-2026-85955) allowing remote attackers with query-execution access to gain administrative control or execute arbitrary code. These vulnerabilities affect releases before 12.1.0 and 11.3.7. The flaws stem from insufficient authorization checks in XQuery evaluation functions, potentially enabling delegated managers to achieve persistent administrative access.
A wave of critical vulnerabilities has been identified in various consumer networking devices, including Wavlink (CVE-2026-109110, CVE-2026-109108), Edimax (CVE-2026-108918, CVE-2026-108914), and Linksys (CVE-2026-108892). These flaws primarily involve command injection and buffer overflow vulnerabilities, often exploitable remotely through web management interfaces. Several Trendnet devices (CVE-2026-108804, CVE-2026-109157) are also affected by similar critical vulnerabilities.
IBM has addressed a significant number of vulnerabilities across its product lines, including IBM i (CVE-2026-96119) and IBM Db2 Mirror for i (CVE-2026-96012), which could lead to information disclosure, arbitrary code execution, or privilege escalation. IBM Maximo AI Service (CVE-2026-90920) also has a critical RCE vulnerability. These disclosures highlight the ongoing need for vigilance and timely patching of IBM systems.