Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-72766 | high | 7.5 | No | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does n... | 2026-10-29 |
| CVE-2026-72764 | high | 8.8 | No | n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.3... | 2026-10-29 |
| CVE-2026-72765 | critical | 9.9 | No | n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission t... | 2026-10-29 |
| CVE-2026-72763 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenc... | 2026-10-29 |
| CVE-2026-72762 | high | 8.8 | No | n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its outp... | 2026-10-29 |
| CVE-2026-72750 | high | 8.8 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interp... | 2026-10-29 |
| CVE-2026-72749 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output... | 2026-10-29 |
| CVE-2026-65599 | medium | 6.5 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account... | 2026-10-29 |
| CVE-2026-65598 | high | 7.5 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users t... | 2026-10-29 |
| CVE-2026-62018 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | 2026-10-29 |
| CVE-2026-62013 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | 2026-10-29 |
| CVE-2026-62008 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | 2026-10-29 |
| CVE-2026-65597 | medium | 5.4 | No | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which... | 2026-10-29 |
| CVE-2026-65596 | high | 8.1 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Au... | 2026-10-29 |
| CVE-2026-65595 | high | 8.8 | No | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting use... | 2026-10-29 |
| CVE-2026-65594 | medium | 6.5 | No | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does no... | 2026-10-29 |
| CVE-2026-65593 | medium | 5.4 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoint... | 2026-10-29 |
| CVE-2026-62002 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | 2026-10-29 |
| CVE-2026-61995 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | 2026-10-29 |
| CVE-2026-61988 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. | 2026-10-29 |