Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51698
Total
4098
Critical
15338
High
14987
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-65599 | UNKNOWN | — | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key … | Jul 22, 2026 |
| CVE-2026-65598 | UNKNOWN | — | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions … | Jul 22, 2026 |
| CVE-2026-65597 | UNKNOWN | — | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an … | Jul 22, 2026 |
| CVE-2026-65596 | UNKNOWN | — | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) … | Jul 22, 2026 |
| CVE-2026-65595 | UNKNOWN | — | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. … | Jul 22, 2026 |
| CVE-2026-65594 | UNKNOWN | — | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the … | Jul 22, 2026 |
| CVE-2026-65593 | UNKNOWN | — | n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in … | Jul 22, 2026 |
| CVE-2026-65592 | UNKNOWN | — | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to … | Jul 22, 2026 |
| CVE-2026-65591 | UNKNOWN | — | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a … | Jul 22, 2026 |
| CVE-2026-65590 | UNKNOWN | — | n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only … | Jul 22, 2026 |
| CVE-2026-65589 | UNKNOWN | — | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow … | Jul 22, 2026 |
| CVE-2026-65016 | UNKNOWN | — | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim … | Jul 22, 2026 |
| CVE-2026-65015 | UNKNOWN | — | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer … | Jul 22, 2026 |
| CVE-2026-65014 | UNKNOWN | — | n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller … | Jul 22, 2026 |
| CVE-2026-61392 | MEDIUM | 5.3 | There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory. | Jul 22, 2026 |
| CVE-2026-61391 | HIGH | 7.2 | There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets. | Jul 22, 2026 |
| CVE-2026-61390 | HIGH | 7.7 | There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets. | Jul 22, 2026 |
| CVE-2026-57600 | HIGH | 7.5 | Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data. | Jul 22, 2026 |
| CVE-2026-57599 | MEDIUM | 6.6 | There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain … | Jul 22, 2026 |
| CVE-2026-4773 | HIGH | 8.1 | Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10. | Jul 22, 2026 |
| CVE-2026-44192 | MEDIUM | 6.6 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an … | Jul 22, 2026 |
| CVE-2026-44190 | HIGH | 7.8 | A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands … | Jul 22, 2026 |
| CVE-2026-44189 | HIGH | 7.8 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook … | Jul 22, 2026 |
| CVE-2026-44187 | LOW | 3.3 | A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or … | Jul 22, 2026 |
| CVE-2026-16551 | UNKNOWN | — | Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only. | Jul 22, 2026 |