Vulnerabilities

2 articles on Vulnerabilities.

Subscribe by RSS

• 

  Secure by Design

  Runtime Security Boundaries Require Runtime Enforcement: Lessons from n8n's CVE Chain

  February 17, 2026

  n8n's five critical CVEs in 90 days share a single architectural flaw: TypeScript type annotations used as runtime security enforcement -- but TypeScript annotations don't exist at JavaScript runtime. The patch for the first CVE was bypassed by the same mechanism two months later. If you build AI agent pipelines or any sandbox with compile-time security constraints, this CVE chain names the failure directly.

• AppSec

  Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935

  February 4, 2026

  CISA added CVE-2021-39935 to the KEV catalog in February 2026. LLM agents with broad API access inherit every vulnerability in your attack surface.