Login Request a demo
N8
Vendor
n8n
1 product with CVEs on record
183
CVEs
1
On KEV
0
New 30D
Products
N8
n8n
n8n
10.0
183 CVEs1 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-86075
N8
N8n
N8n
7.5
1%
Sep 8n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
CVE-2026-86076
N8
N8n
N8n
8.8
1%
Sep 8n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
CVE-2026-86077
N8
N8n
N8n
6.5
0%
Sep 8n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
CVE-2026-86078
N8
N8n
N8n
6.5
1%
Sep 8n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
CVE-2026-86079
N8
N8n
N8n
6.5
0%
Sep 8n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
CVE-2026-86080
N8
N8n
N8n
5.3
0%
Sep 8n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
CVE-2026-86082
N8
N8n
N8n
6.5
0%
Sep 8n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
CVE-2026-86083
N8
N8n
N8n
8.8
1%
Sep 8n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
CVE-2026-86084
N8
N8n
N8n
5.5
0%
Sep 8n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
CVE-2026-86085
N8
N8n
N8n
4.9
0%
Sep 8n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
CVE-2026-86993
N8
N8n
N8n
4.9
0%
Sep 8n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
CVE-2026-86994
N8
N8n
N8n
4.3
0%
Sep 8n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
CVE-2026-86995
N8
N8n
N8n
4.3
0%
Sep 8n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
CVE-2026-86996
N8
N8n
N8n
5.4
0%
Sep 8n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
CVE-2026-86074
N8
N8n
N8n
7.1
0%
Sep 8n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
CVE-2026-86073
N8
N8n
N8n
7.6
0%
Sep 8n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
CVE-2026-85173
N8
N8n
N8n
4.3
0%
Sep 3n8n before 2.36.2 Missing Authorization via Insights API
CVE-2026-85172
N8
N8n
N8n
6.4
0%
Sep 3n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
CVE-2026-85171
N8
N8n
N8n
6.5
1%
Sep 3n8n before 1.123.73 Credential Exposure via Error Logging
CVE-2026-85170
N8
N8n
N8n
6.5
0%
Sep 3n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
CVE-2026-85169
N8
N8n
N8n
8.8
1%
Sep 3n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
CVE-2026-85168
N8
N8n
N8n
8.8
1%
Sep 3n8n before 1.123.73 Remote Code Execution via Git Node
CVE-2026-85167
N8
N8n
N8n
6.5
0%
Sep 3n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
CVE-2026-85166
N8
N8n
N8n
6.5
0%
Sep 3n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
CVE-2026-85165
N8
N8n
N8n
9.9
1%
Sep 3n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
CVE-2026-77085
N8
N8n
N8n
6.5
0%
Aug 20n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
CVE-2026-77084
N8
N8n
N8n
8.8
1%
Aug 20n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values
CVE-2026-77083
N8
N8n
N8n
5.9
0%
Aug 20n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
CVE-2026-77082
N8
N8n
N8n
4.3
0%
Aug 20n8n before 1.123.69 ReDoS via Filter and Switch Node
CVE-2026-77081
N8
N8n
N8n
7.1
0%
Aug 20n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
CVE-2026-77080
N8
N8n
N8n
8.8
1%
Aug 20n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
CVE-2026-77079
N8
N8n
N8n
8.8
0%
Aug 20n8n before 2.34.1 Authorization Bypass via Custom Role Deletion
CVE-2026-77077
N8
N8n
N8n
7.6
1%
Aug 20n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
CVE-2026-77076
N8
N8n
N8n
6.5
0%
Aug 20n8n before 1.123.69 Credential Leak via GraphQL Node Error
CVE-2026-77075
N8
N8n
N8n
7.3
0%
Aug 20n8n before 1.123.69 Expression Injection via Resource Locator
CVE-2026-77074
N8
N8n
N8n
6.5
0%
Aug 20n8n before 1.123.69 SSRF via Edit Image Node
CVE-2026-77073
N8
N8n
N8n
4.3
0%
Aug 20n8n before 2.34.1 Cross-Project Credential Access via MCP
CVE-2026-77072
N8
N8n
N8n
7.6
0%
Aug 20n8n before 1.123.69 Stored XSS via Form Completion Page
CVE-2026-77071
N8
N8n
N8n
9.8
1%
Aug 20n8n before 1.123.69 PostgREST Filter Injection via Supabase
CVE-2026-77070
N8
N8n
N8n
9.8
1%
Aug 20n8n before 1.123.69 NoSQL Injection via MongoDB Node
CVE-2026-77069
N8
N8n
N8n
4.3
0%
Aug 20n8n before 1.123.69 SSRF Protection Bypass via OAuth2
CVE-2026-77068
N8
N8n
N8n
8.8
1%
Aug 20n8n before 2.34.1 Remote Code Execution via Path Traversal
CVE-2026-72775
N8
N8n
N8n
8.8
0%
Aug 11n8n before 1.123.67 SQL Injection via PostgresTrigger Node
CVE-2026-72774
N8
N8n
N8n
6.5
0%
Aug 11n8n before 1.123.67 Authentication Bypass via HTTP Request Node
CVE-2026-72773
N8
N8n
N8n
7.7
1%
Aug 11n8n before 2.32.1 Path Traversal via computer-use search_files
CVE-2026-72772
N8
N8n
N8n
8.8
0%
Aug 11n8n before 2.32.1 Authentication Bypass via Token Exchange
CVE-2026-72771
N8
N8n
N8n
6.5
0%
Aug 11n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes
CVE-2026-72770
N8
N8n
N8n
6.5
1%
Aug 11n8n before 1.123.67 Path Traversal via Git Node Operations
CVE-2026-72769
N8
N8n
N8n
8.1
1%
Aug 11n8n before 1.123.67 Prototype Pollution via VM Expression Engine
CVE-2026-72768
N8
N8n
N8n
8.3
0%
Aug 11n8n before 2.32.1 SSRF Protection Bypass via MCP Client
CVE-2026-72767
N8
N8n
N8n
8.8
1%
Aug 11n8n before 1.123.67 Remote Code Execution via Git node
CVE-2026-72766
N8
N8n
N8n
7.5
0%
Aug 11n8n before 1.123.67 Arbitrary File Read via Send Email Node
CVE-2026-72765
N8
N8n
N8n
9.9
1%
Aug 11n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
CVE-2026-72764
N8
N8n
N8n
8.8
1%
Aug 11n8n before 1.123.67 Module Cache Poisoning via Code Node
CVE-2026-72763
N8
N8n
N8n
6.5
0%
Aug 11n8n before 1.123.67 Credential Exfiltration via Sub-Workflow
CVE-2026-72762
N8
N8n
N8n
8.8
0%
Aug 11n8n before 1.123.67 Arbitrary File Write via Edit Image Node
CVE-2026-72750
N8
N8n
N8n
8.8
0%
Aug 11n8n before 1.123.67 SQL Injection via executeQuery Operation
CVE-2026-72749
N8
N8n
N8n
6.5
1%
Aug 11n8n before 1.123.67 Prototype Pollution via Edit Fields
CVE-2026-65599
N8
N8n
N8n
6.5
0%
Jul 22n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header
CVE-2026-65598
N8
N8n
N8n
7.5
0%
Jul 22n8n before 1.123.64 Remote Code Execution via Git Clone