n8n-io n8n

• CVE-2025-68613 Critical 10.0 Exploited n8n Vulnerable to Remote Code Execution via Expression Injection 99.0%
• CVE-2026-119557 Medium 5.9 n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node 0.5%
• CVE-2026-119408 High 8.8 n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes 0.6%
• CVE-2026-118679 High 7.5 n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger 0.3%
• CVE-2026-118678 High 7.1 n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction 0.3%
• CVE-2026-118677 Medium 5.9 n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance 0.2%
• CVE-2026-118676 High 7.1 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass 0.2%
• CVE-2026-118675 High 7.1 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow 0.2%
• CVE-2026-118649 High 8.3 n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables 0.3%
• CVE-2026-118648 High 7.3 n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy 0.3%
• CVE-2026-118647 High 8.2 n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data 0.3%
• CVE-2026-118646 Medium 6.5 n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node 0.2%
• CVE-2026-118645 High 8.7 n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter 0.2%
• CVE-2026-118644 High 7.7 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance 0.2%
• CVE-2026-118643 High 8.2 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data 0.3%
• CVE-2026-118642 High 7.1 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows 0.2%
• CVE-2026-118641 High 7.5 n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes 0.3%
• CVE-2026-118640 Medium 5.4 n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass 0.2%
• CVE-2026-110853 High 7.1 n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON 0.2%
• CVE-2026-110852 Medium 6.3 n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution 0.4%
• CVE-2026-110851 Medium 6.1 n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint 0.2%
• CVE-2026-110850 High 7.2 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters 0.2%
• CVE-2026-110849 High 7.2 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview 0.2%
• CVE-2026-110848 Medium 6.0 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge 0.3%
• CVE-2026-110847 High 7.0 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter 0.4%
• CVE-2026-110846 High 7.0 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook 0.5%
• CVE-2026-110845 High 7.7 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation 0.3%
• CVE-2026-110844 High 7.2 n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows 0.3%
• CVE-2026-110843 High 8.2 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint 0.3%
• CVE-2026-110842 High 7.7 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter 0.3%
• CVE-2026-110841 Medium 6.1 n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval 0.3%
• CVE-2026-110840 High 7.0 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field 0.3%
• CVE-2026-103260 Medium 4.0 n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node 0.3%
• CVE-2026-103259 High 7.6 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials 0.2%
• CVE-2026-103258 Medium 6.8 n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation 0.3%
• CVE-2026-103257 High 7.7 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node 0.4%
• CVE-2026-103256 High 7.1 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook 0.2%
• CVE-2026-103255 Critical 9.0 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase 0.3%
• CVE-2026-103254 Medium 6.3 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation 0.3%
• CVE-2026-103253 High 8.7 n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table 0.2%
• CVE-2026-103252 High 7.7 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint 0.3%
• CVE-2026-103251 High 7.1 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub 0.2%
• CVE-2026-103250 High 8.1 n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory 0.2%
• CVE-2026-103249 High 7.6 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator 0.2%
• CVE-2026-103248 Critical 9.0 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase 0.3%
• CVE-2026-103247 High 8.5 n8n before 1.123.80 Credential Tampering via Duplicate Node IDs 0.2%
• CVE-2026-103246 High 7.7 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection 0.3%
• CVE-2026-103245 Medium 5.3 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification 0.2%
• CVE-2026-92588 Medium 4.4 n8n before 1.123.76 Improper Authorization via Source Control Push 0.3%
• CVE-2026-92587 Medium 5.0 n8n before 1.123.76 Sandbox Escape via Git Relative URL 0.3%