Login Request a demo
N8
Vendor
n8n-io
1 product with CVEs on record
204
CVEs
1
On KEV
45
New 30D
Products
N8
n8n
n8n-io
10.0
204 CVEs1 on KEV45 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-118679
New
N8
n8n
n8n-io
7.5–Oct 28n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
CVE-2026-118678
New
N8
n8n
n8n-io
7.1–Oct 28n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
CVE-2026-118677
New
N8
n8n
n8n-io
5.9–Oct 28n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
CVE-2026-118676
New
N8
n8n
n8n-io
7.1–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
CVE-2026-118675
New
N8
n8n
n8n-io
7.1–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
CVE-2026-118649
New
N8
n8n
n8n-io
8.3–Oct 28n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
CVE-2026-118648
New
N8
n8n
n8n-io
7.3–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
CVE-2026-118647
New
N8
n8n
n8n-io
8.2–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
CVE-2026-118646
New
N8
n8n
n8n-io
6.5–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
CVE-2026-118645
New
N8
n8n
n8n-io
8.7–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
CVE-2026-118644
New
N8
n8n
n8n-io
7.7–Oct 28n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
CVE-2026-118643
New
N8
n8n
n8n-io
8.2–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
CVE-2026-118642
New
N8
n8n
n8n-io
7.1–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
CVE-2026-118641
New
N8
n8n
n8n-io
7.5–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
CVE-2026-118640
New
N8
n8n
n8n-io
5.4–Oct 28n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
CVE-2026-110853
N8
n8n
n8n-io
7.1
0%
Oct 14n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
CVE-2026-110852
N8
n8n
n8n-io
6.3
0%
Oct 14n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
CVE-2026-110851
N8
n8n
n8n-io
6.1
0%
Oct 14n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
CVE-2026-110850
N8
n8n
n8n-io
7.2
0%
Oct 14n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
CVE-2026-110849
N8
n8n
n8n-io
7.2
0%
Oct 14n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
CVE-2026-110848
N8
n8n
n8n-io
6.0
0%
Oct 14n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
CVE-2026-110847
N8
n8n
n8n-io
7.0
0%
Oct 14n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter
CVE-2026-110846
N8
n8n
n8n-io
7.0
1%
Oct 14n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
CVE-2026-110845
N8
n8n
n8n-io
7.7
0%
Oct 14n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
CVE-2026-110844
N8
n8n
n8n-io
7.2
0%
Oct 14n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
CVE-2026-110843
N8
n8n
n8n-io
8.2
0%
Oct 14n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
CVE-2026-110842
N8
n8n
n8n-io
7.7
0%
Oct 14n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
CVE-2026-110841
N8
n8n
n8n-io
6.1
0%
Oct 14n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
CVE-2026-110840
N8
n8n
n8n-io
7.0
0%
Oct 14n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
CVE-2026-103260
N8
n8n
n8n-io
4.0
0%
Oct 1n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
CVE-2026-103259
N8
n8n
n8n-io
7.6
0%
Oct 1n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
CVE-2026-103258
N8
n8n
n8n-io
6.8
0%
Oct 1n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
CVE-2026-103257
N8
n8n
n8n-io
7.7
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
CVE-2026-103256
N8
n8n
n8n-io
7.1
0%
Oct 1n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
CVE-2026-103255
N8
n8n
n8n-io
9.0
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
CVE-2026-103254
N8
n8n
n8n-io
6.3
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
CVE-2026-103253
N8
n8n
n8n-io
8.7
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
CVE-2026-103252
N8
n8n
n8n-io
7.7
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
CVE-2026-103251
N8
n8n
n8n-io
7.1
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
CVE-2026-103250
N8
n8n
n8n-io
8.1
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
CVE-2026-103249
N8
n8n
n8n-io
7.6
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
CVE-2026-103248
N8
n8n
n8n-io
9.0
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
CVE-2026-103247
N8
n8n
n8n-io
8.5
0%
Oct 1n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
CVE-2026-103246
N8
n8n
n8n-io
7.7
0%
Oct 1n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
CVE-2026-103245
N8
n8n
n8n-io
5.3
0%
Oct 1n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
CVE-2026-92588
N8
n8n
n8n-io
4.4
0%
Sep 16n8n before 1.123.76 Improper Authorization via Source Control Push
CVE-2026-92587
N8
n8n
n8n-io
5.0
0%
Sep 16n8n before 1.123.76 Sandbox Escape via Git Relative URL
CVE-2026-86075
N8
n8n
n8n-io
7.5
1%
Sep 8n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
CVE-2026-86076
N8
n8n
n8n-io
8.8
1%
Sep 8n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
CVE-2026-86077
N8
n8n
n8n-io
6.5
0%
Sep 8n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
CVE-2026-86078
N8
n8n
n8n-io
6.5
1%
Sep 8n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
CVE-2026-86079
N8
n8n
n8n-io
6.5
0%
Sep 8n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
CVE-2026-86080
N8
n8n
n8n-io
5.3
0%
Sep 8n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
CVE-2026-86081
N8
n8n
n8n-io
7.1
1%
Sep 8n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
CVE-2026-86082
N8
n8n
n8n-io
6.5
0%
Sep 8n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
CVE-2026-86083
N8
n8n
n8n-io
8.8
1%
Sep 8n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
CVE-2026-86084
N8
n8n
n8n-io
5.5
0%
Sep 8n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
CVE-2026-86085
N8
n8n
n8n-io
4.9
0%
Sep 8n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
CVE-2026-86993
N8
n8n
n8n-io
4.9
0%
Sep 8n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
CVE-2026-86994
N8
n8n
n8n-io
4.3
0%
Sep 8n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter