Loading story…
CERT Polska disclosed four vulnerabilities in the nnn file manager, confirming that version 5.2 is affected. The issues include CVE-2026-65609, an out-of-bounds write triggered by a crafted session file; CVE-2026-65610, a numeric truncation error classified as CWE-197 involving the HOME path that can cause out-of-bounds read and write; and CVE-2026-65611 plus CVE-2026-65612, two OS command injection flaws caused by unsanitized directory and filename values.
Successful exploitation could let an attacker corrupt memory or execute attacker-controlled shell commands with the privileges of the nnn process. CERT Polska said it coordinated disclosure with the project maintainer, but a complete vulnerable version range was not provided, leaving only version 5.2 confirmed as vulnerable at publication.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 19 August 2026, CERT Polska disclosed four vulnerabilities in the nnn file manager: CVE-2026-65609, CVE-2026-65610, CVE-2026-65611, and CVE-2026-65612. CERT Polska confirmed version 5.2 as vulnerable and noted the maintainer did not provide a full vulnerable version range.
CERT Polska said Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team were credited for the responsible vulnerability report, and that disclosure was coordinated with the nnn project maintainer. The report covered four flaws in nnn, including memory corruption and command injection issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcecert.pl
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical `CVSS 10.0` vulnerability in locally deployed n8n automation instances, tracked as `CVE-2026-21858` and dubbed **Ni8mare**, enables unauthenticated attackers to read arbitrary local files, bypass authentication, and execute commands. The flaw stems from Content-Type confusion in webhook parsing: the Form Webhook node can invoke file handling without requiring `multipart/form-data`, allowing attacker-controlled file paths to be copied into persistent storage. Researchers estimate that roughly 100,000 internet-exposed servers may be affected. Attackers can use the file-read primitive to obtain sensitive files, including `/etc/passwd`, the local SQLite database, and n8n configuration secrets. With database contents and the instance secret, they can forge an `n8n-auth` session cookie, gain administrator access, and create workflows using the **Execute Command** node for remote code execution. Organizations running self-hosted n8n should upgrade to version `1.121.0` or later; no official workaround is available.
Sep 18, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026
Two high-severity vulnerabilities in **pnpm** exposed developers to supply-chain compromise through routine package installation and automatic package-manager switching. **`CVE-2026-55698`** affects versions before **10.34.2** and **11.5.3** and allows a malicious repository to poison metadata in the first YAML document of `pnpm-lock.yaml`, causing direct pnpm execution to trust lockfile-selected package-manager artifacts and run attacker-chosen pnpm bytes. The vulnerable flow reached package-manager installation and execution during auto-switching, and the fix forces fresh resolution of package-manager entries from trusted registries before execution.
Jun 29, 2026