n8n-io n8n

• CVE-2026-72769 Medium 6.1 n8n before 1.123.67 Prototype Pollution via VM Expression Engine 0.5%
• CVE-2026-72768 Medium 6.4 n8n before 2.32.1 SSRF Protection Bypass via MCP Client 0.4%
• CVE-2026-72767 High 8.7 n8n before 1.123.67 Remote Code Execution via Git node 0.9%
• CVE-2026-72766 High 8.2 n8n before 1.123.67 Arbitrary File Read via Send Email Node 0.4%
• CVE-2026-72765 High 8.7 n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape 0.9%
• CVE-2026-72764 Medium 5.8 n8n before 1.123.67 Module Cache Poisoning via Code Node 0.8%
• CVE-2026-72763 High 7.2 n8n before 1.123.67 Credential Exfiltration via Sub-Workflow 0.4%
• CVE-2026-72762 High 7.7 n8n before 1.123.67 Arbitrary File Write via Edit Image Node 0.5%
• CVE-2026-72750 Medium 5.3 n8n before 1.123.67 SQL Injection via executeQuery Operation 0.5%
• CVE-2026-72749 High 7.1 n8n before 1.123.67 Prototype Pollution via Edit Fields 0.6%
• CVE-2026-65599 Medium 5.1 n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header 0.2%
• CVE-2026-65598 High 8.9 n8n before 1.123.64 Remote Code Execution via Git Clone 0.3%
• CVE-2026-65597 High 8.2 n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe 0.3%
• CVE-2026-65596 Medium 5.1 n8n before 1.123.64 Credential Exfiltration via GraphQL Node 0.4%
• CVE-2026-65595 High 8.9 n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange 0.7%
• CVE-2026-65594 Medium 5.1 n8n before 2.30.1 Missing OAuth Authorization Check 0.4%
• CVE-2026-65593 Medium 6.3 n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters 0.2%
• CVE-2026-65592 High 8.4 n8n before 1.123.64 Stored DOM XSS via cachedResultUrl 0.2%
• CVE-2026-65591 High 8.9 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution 0.7%
• CVE-2026-65590 Medium 5.5 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows 0.6%
• CVE-2026-65589 Medium 5.1 n8n before 1.123.64 Credential Exposure via LLM Node Execution Data 0.5%
• CVE-2026-65016 High 7.7 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role 0.4%
• CVE-2026-65015 High 7.2 n8n before 2.30.1 Privilege Escalation via run_node_tool 0.6%
• CVE-2026-65014 Medium 6.3 n8n before 2.28.0 Authentication Bypass via test-webhook 0.6%
• CVE-2026-59209 High 7.1 n8n: Shared Credential Header Leak via HTTP Request Pagination Expression 0.4%
• CVE-2026-59206 High 7.1 n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration 0.7%
• CVE-2026-59208 High 7.6 n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution 0.3%
• CVE-2026-59207 High 7.1 n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector 0.4%
• CVE-2026-44792 High 8.9 n8n: Source Control Pull SQL Injection 0.4%
• CVE-2026-44791 Critical 9.4 n8n: XML Node Prototype Pollution Patch Bypass 0.5%
• CVE-2026-44790 Critical 9.4 n8n: Arbitrary File Read via Git Node 0.5%
• CVE-2026-44789 Critical 9.4 n8n: HTTP Request Node Pagination Prototype Pollution to RCE 0.5%
• CVE-2026-45732 High 8.3 n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints 0.4%
• CVE-2026-49444 High 7.1 n8n: Python sandbox escape 0.4%
• CVE-2026-49465 Medium 6.0 n8n: Git Node Clone and Push Operations Bypass File Sandbox 0.5%
• CVE-2026-54304 High 7.1 n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host 0.4%
• CVE-2026-54307 High 8.5 n8n: Credential Exfiltration via Permission Bypass 0.4%
• CVE-2026-54302 High 7.0 n8n: Stored XSS in Chat Trigger Node 0.2%
• CVE-2026-54305 High 8.9 n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints 0.4%
• CVE-2026-54301 High 7.0 n8n: Same-Origin XSS in Respond to Webhook Node 0.2%
• CVE-2026-54306 Medium 6.3 n8n: Prototype Pollution enables confused-deputy execution via public webhooks 0.3%
• CVE-2026-54308 Medium 6.3 n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node 0.3%
• CVE-2026-54311 Medium 6.0 n8n: Merge Node SQL Mode Prototype Pollution 0.4%
• CVE-2026-54310 Medium 6.5 n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes 0.5%
• CVE-2026-54309 High 8.8 n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions 0.5%
• CVE-2026-54314 Medium 6.3 n8n: Denial of Service via ZIP decompression in webhook workflow 0.5%
• CVE-2026-54312 High 7.2 n8n: Microsoft SQL Node Prototype Pollution 0.4%
• CVE-2026-54303 Medium 6.8 n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints 0.2%
• CVE-2026-54313 Medium 6.5 n8n: NoSQL Injection in MongoDB Node Find And Replace Operation 0.3%
• CVE-2026-42237 Medium 5.3 n8n: SQL Injection in Snowflake and MySQL Nodes 0.3%