| CVE-2026-54309 | 10 | critical | n8n | n8n is an open source workflow automation platform. | 121d ago |
| CVE-2026-72765 | 9.9 | critical | n8n | n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. | 72d ago |
| CVE-2026-44789 | 9.9 | critical | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-54305 | 9.9 | critical | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-54310 | 9.9 | critical | n8n | n8n is an open source workflow automation platform. | 121d ago |
| CVE-2026-44791 | 9.9 | critical | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-65590 | 9.8 | critical | n8n | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the | 92d ago |
| CVE-2026-77071 | 9.8 | critical | n8n | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's | 63d ago |
| CVE-2026-77070 | 9.8 | critical | n8n | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delet | 63d ago |
| CVE-2026-54307 | 9.6 | critical | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-56348 | 9.1 | critical | n8n | n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/optio | 121d ago |
| CVE-2026-44792 | 9 | critical | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-72775 | 8.8 | high | n8n | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which | 72d ago |
| CVE-2026-44790 | 8.8 | high | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-59257 | 8.8 | high | n8n | n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the leg | 106d ago |
| CVE-2026-65015 | 8.8 | high | n8n | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-ex | 92d ago |
| CVE-2026-65016 | 8.8 | high | n8n | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO in | 92d ago |
| CVE-2026-65591 | 8.8 | high | n8n | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. | 92d ago |
| CVE-2026-65595 | 8.8 | high | n8n | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module re | 92d ago |
| CVE-2026-72750 | 8.8 | high | n8n | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Que | 72d ago |
| CVE-2026-77068 | 8.8 | high | n8n | n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk | 63d ago |
| CVE-2026-77079 | 8.8 | high | n8n | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) p | 63d ago |
| CVE-2026-77080 | 8.8 | high | n8n | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerab | 63d ago |
| CVE-2026-77084 | 8.8 | high | n8n | n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. | 63d ago |
| CVE-2026-54312 | 8.5 | high | n8n | n8n is an open source workflow automation platform. | 121d ago |
| CVE-2026-49444 | 8.5 | high | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-72768 | 8.3 | high | n8n | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client | 72d ago |
| CVE-2026-56351 | 8.2 | high | n8n | n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that | 120d ago |
| CVE-2026-45732 | 8.1 | high | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-65596 | 8.1 | high | n8n | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-ba | 92d ago |
| CVE-2026-54311 | 7.7 | high | n8n | n8n is an open source workflow automation platform. | 121d ago |
| CVE-2026-72773 | 7.7 | high | n8n | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search | 72d ago |
| CVE-2026-54313 | 7.7 | high | n8n | n8n is an open source workflow automation platform. | 121d ago |
| CVE-2026-54304 | 7.7 | high | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-49465 | 7.7 | high | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-77077 | 7.6 | high | n8n | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. | 63d ago |
| CVE-2026-77072 | 7.6 | high | n8n | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's co | 63d ago |
| CVE-2026-54314 | 7.5 | high | n8n | n8n is an open source workflow automation platform. | 121d ago |
| CVE-2026-65598 | 7.5 | high | n8n | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that al | 92d ago |
| CVE-2026-72766 | 7.5 | high | n8n | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Sen | 72d ago |
| CVE-2026-56776 | 7.4 | high | n8n | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test- | 106d ago |
| CVE-2026-77075 | 7.3 | high | n8n | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in | 63d ago |
| CVE-2026-54308 | 7.2 | high | n8n | n8n is an open source workflow automation platform. | 120d ago |
| CVE-2026-77081 | 7.1 | high | n8n | n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL nod | 63d ago |
| CVE-2026-59206 | 7.1 | high | n8n | n8n is an open source workflow automation platform. | 105d ago |
