CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,437
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product n8n:n8n. Show all products

168 CVEs, showing 51 to 100PreviousPage 2 of 4Next
CVESeverityTitlePublished
CVE-2026-72767High 8.7n8n before 1.123.67 Remote Code Execution via Git node
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72766High 8.2n8n before 1.123.67 Arbitrary File Read via Send Email Node
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72765High 8.7n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72764Medium 5.8n8n before 1.123.67 Module Cache Poisoning via Code Node
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72763High 7.2n8n before 1.123.67 Credential Exfiltration via Sub-Workflow
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72762High 7.7n8n before 1.123.67 Arbitrary File Write via Edit Image Node
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72750Medium 5.3n8n before 1.123.67 SQL Injection via executeQuery Operation
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-72749High 7.1n8n before 1.123.67 Prototype Pollution via Edit Fields
Assigned by VulnCheck
Aug 11, 2026
CVE-2026-65599Medium 6.5n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the…Jul 22, 2026
CVE-2026-65598High 7.5n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a sy…Jul 22, 2026
CVE-2026-65597Medium 5.4n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the…Jul 22, 2026
CVE-2026-65596High 8.1n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unl…Jul 22, 2026
CVE-2026-65595High 8.8n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role.Jul 22, 2026
CVE-2026-65594Medium 6.5n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the work…Jul 22, 2026
CVE-2026-65593Medium 5.4n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes.Jul 22, 2026
CVE-2026-65592Medium 5.4n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to wi…Jul 22, 2026
CVE-2026-65591High 8.8n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler.Jul 22, 2026
CVE-2026-65590Critical 9.8n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS).Jul 22, 2026
CVE-2026-65589Medium 6.5n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records.Jul 22, 2026
CVE-2026-65016High 8.8n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning.Jul 22, 2026
CVE-2026-65015High 8.8n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks.Jul 22, 2026
CVE-2026-65014Medium 5.3n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated ne…Jul 22, 2026
CVE-2026-59259Medium 6.5n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expre…Jul 15, 2026
CVE-2026-56353Medium 4.8n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration).Jul 15, 2026
CVE-2026-58661Medium 4.3n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint.Jul 10, 2026
CVE-2026-56354Medium 5.4n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields a…Jul 10, 2026
CVE-2026-59209Medium 6.5n8n is an open source workflow automation platform.Jul 9, 2026
CVE-2026-59208Medium 6.8n8n is an open source workflow automation platform.Jul 9, 2026
CVE-2026-59207Medium 6.5n8n is an open source workflow automation platform.Jul 9, 2026
CVE-2026-59206High 7.1n8n is an open source workflow automation platform.Jul 9, 2026
CVE-2026-59257High 8.8n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation.Jul 8, 2026
CVE-2026-59253Medium 5.0n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects.Jul 8, 2026
CVE-2026-56778Medium 6.4n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execu…Jul 8, 2026
CVE-2026-56776High 7.4n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of w…Jul 8, 2026
CVE-2026-56775Medium 5.4n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope ins…Jul 8, 2026
CVE-2026-56360Medium 4.0n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node.Jul 8, 2026
CVE-2026-56359Medium 5.4n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization UR…Jul 8, 2026
CVE-2026-56777Medium 5.0n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node.Jun 30, 2026
CVE-2026-56356Medium 5.4n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library.Jun 30, 2026
CVE-2026-56350High 7.7n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API.Jun 30, 2026
CVE-2026-56358Medium 5.4n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows a…Jun 24, 2026
CVE-2026-56351Critical 9.6n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier valu…Jun 24, 2026
CVE-2026-54308High 7.2n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-54307Critical 9.6n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-54306Medium 6.4n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-54305Critical 9.9n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-54304High 7.7n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-54302Medium 5.4n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-54301Medium 5.4n8n is an open source workflow automation platform.Jun 23, 2026
CVE-2026-49465High 7.7n8n is an open source workflow automation platform.Jun 23, 2026
PreviousPage 2 of 4Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.