September 30, 2026
- CVE-2026-33696: prototype pollution in n8n's GSuite Admin node escalates from a controllable schema name to remote code execution on the automation host (Simon Köck). Separately, CVE-2026-6837 is a command injection in Zyxel's
export-cgiPKCS#12 export handler (write-up). · Vulnerabilities & Exploits
in Mandiant Names the NetScaler Post-Exploitation Kit as Patch Rates Stay Under 10%