267464 matches found
CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...
CVE-2026-103245
Versions of n8n prior to 1.123.80, 2.39.6, and 2.40.1 are vulnerable to a missing webhook signature verification flaw in the Webflow Trigger node webhook handler. The application fails to verify the x-webflow-signature HMAC, allowing unauthenticated attackers to send forged webhook requests with ...
CVE-2026-103245
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...
BIT-RABBITMQ-2026-67226 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...
BIT-RABBITMQ-2026-66073 RabbitMQ: Atom table exhaustion via management API node field
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...
BIT-RABBITMQ-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...
Prototype Pollution
Axios is vulnerable to prototype pollution. The vulnerability is due to the Node HTTP adapter not setting its own createConnection property, where the adapter supplies request options without an own createConnection value and Node resolves and invokes an inherited Object.prototype.createConnectio...
ROOT-APP-NPM-CVE-2026-2391 CVE-2026-2391 in qs - Patched by Root
Root has patched CVE-2026-2391 in the qs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-24999 CVE-2022-24999 in qs - Patched by Root
Root has patched CVE-2022-24999 in the qs package for Root:npm. Multiple fixed versions available...
CVE-2026-102277 vulnerabilities
Vulnerabilities for packages: commitizen, redisinsight, unleash-proxy, commercial-gitlab-rails-ee-fips, langfuse-fips, commercial-gitlab-rails-ee, sqlpad, gitlab-rails-ce-fips, npm, authentik-fips, renovate, lambda-nodejs, jupyter-base-notebook, gitlab-rails-ce, arangodb, wazuh-dashboard,...
CVE-2026-102278 vulnerabilities
Vulnerabilities for packages: commitizen, redisinsight, unleash-proxy, commercial-gitlab-rails-ee-fips, langfuse-fips, commercial-gitlab-rails-ee, sqlpad, gitlab-rails-ce-fips, npm, authentik-fips, renovate, lambda-nodejs, jupyter-base-notebook, gitlab-rails-ce, arangodb, wazuh-dashboard,...
GHSA-Q2HR-2G5M-VWHR vulnerabilities
Vulnerabilities for packages: commitizen, redisinsight, unleash-proxy, commercial-gitlab-rails-ee-fips, langfuse-fips, commercial-gitlab-rails-ee, sqlpad, gitlab-rails-ce-fips, npm, authentik-fips, renovate, lambda-nodejs, jupyter-base-notebook, gitlab-rails-ce, arangodb, wazuh-dashboard,...
GHSA-QHR7-859C-M2P7 vulnerabilities
Vulnerabilities for packages: commitizen, redisinsight, unleash-proxy, commercial-gitlab-rails-ee-fips, langfuse-fips, commercial-gitlab-rails-ee, sqlpad, gitlab-rails-ce-fips, npm, authentik-fips, renovate, lambda-nodejs, jupyter-base-notebook, gitlab-rails-ce, arangodb, wazuh-dashboard,...
CVE-2026-103247: Authorization Bypass Through User-Controlled Key
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim credentials and redirect secrets to...
PT-2026-105158
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...
CVE-2026-103260: Missing Authorization
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advan...
CVE-2026-103253: Improper Neutralization of Special Elements used in an SQL Command
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute D...
PT-2026-103779
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.39.6 n8n versions 2.40.0 through 2.40.0 Description Insufficient validation of credential ownership occurs during inline agent node-tool introspection. This allows attackers to reference arbitrary credential IDs to...
PT-2026-103793
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advan...
PT-2026-103787
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the signed resume URL generation for Send-and-Wait approvals. Users with workflow creation permissions can forge...