Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89059 | high | 7.5 | No | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the dec... | 2026-10-29 |
| CVE-2026-78376 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result... | 2026-10-29 |
| CVE-2026-72770 | medium | 6.5 | No | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows auth... | 2026-10-29 |
| CVE-2026-72769 | high | 8.1 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able... | 2026-10-29 |
| CVE-2026-72768 | high | 8.3 | No | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenti... | 2026-10-29 |
| CVE-2026-72767 | high | 8.8 | No | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticate... | 2026-10-29 |
| CVE-2026-72766 | high | 7.5 | No | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does n... | 2026-10-29 |
| CVE-2026-72764 | high | 8.8 | No | n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.3... | 2026-10-29 |
| CVE-2026-72765 | critical | 9.9 | No | n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission t... | 2026-10-29 |
| CVE-2026-67205 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-67203 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-72763 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenc... | 2026-10-29 |
| CVE-2026-72762 | high | 8.8 | No | n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its outp... | 2026-10-29 |
| CVE-2026-72750 | high | 8.8 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interp... | 2026-10-29 |
| CVE-2026-72749 | medium | 6.5 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output... | 2026-10-29 |
| CVE-2026-65599 | medium | 6.5 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account... | 2026-10-29 |
| CVE-2026-65598 | high | 7.5 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users t... | 2026-10-29 |
| CVE-2026-65597 | medium | 5.4 | No | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which... | 2026-10-29 |
| CVE-2026-65596 | high | 8.1 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Au... | 2026-10-29 |
| CVE-2026-65595 | high | 8.8 | No | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting use... | 2026-10-29 |