Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65599 | medium | 6.5 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account... | 2026-10-29 |
| CVE-2026-65598 | high | 7.5 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users t... | 2026-10-29 |
| CVE-2026-65597 | medium | 5.4 | No | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which... | 2026-10-29 |
| CVE-2026-65596 | high | 8.1 | No | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Au... | 2026-10-29 |
| CVE-2026-65595 | high | 8.8 | No | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting use... | 2026-10-29 |
| CVE-2026-65594 | medium | 6.5 | No | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does no... | 2026-10-29 |
| CVE-2026-65593 | medium | 5.4 | No | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoint... | 2026-10-29 |
| CVE-2026-62018 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Gunslinger | 2026-10-29 |
| CVE-2026-62013 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Edge Decor | 2026-10-29 |
| CVE-2026-62008 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Orpheus | 2026-10-29 |
| CVE-2026-62002 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Meals & Wheels | 2026-10-29 |
| CVE-2026-61995 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase | 2026-10-29 |
| CVE-2026-61988 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site | 2026-10-29 |
| CVE-2026-54859 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Preservation | 2026-10-29 |
| CVE-2026-42692 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding | 2026-10-29 |
| CVE-2026-25448 | medium | 4.3 | No | Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue... | 2026-10-29 |
| CVE-2026-118081 | high | 8.8 | No | Contributor PHP Object Injection in 10Web Social Photo Feed | 2026-10-29 |
| CVE-2026-118076 | high | 8.8 | No | Contributor PHP Object Injection in Frisbii Pay | 2026-10-29 |
| CVE-2026-116868 | high | 8.8 | No | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types | 2026-10-29 |
| CVE-2026-118097 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-vid... | 2026-10-29 |