Export limit exceeded: 381188 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 381188 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 381188 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381188 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74020 | 2026-08-20 | 7.5 High | ||
| Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | ||||
| CVE-2026-74019 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. | ||||
| CVE-2026-74018 | 2026-08-20 | 9.9 Critical | ||
| Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. | ||||
| CVE-2026-74016 | 2026-08-20 | 9.9 Critical | ||
| Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. | ||||
| CVE-2026-74013 | 2026-08-20 | 8.5 High | ||
| Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. | ||||
| CVE-2026-73998 | 2026-08-20 | 8.5 High | ||
| Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. | ||||
| CVE-2026-66677 | 2026-08-20 | 7.6 High | ||
| Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | ||||
| CVE-2026-66614 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions. | ||||
| CVE-2026-66606 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions. | ||||
| CVE-2026-66594 | 2026-08-20 | 8.5 High | ||
| Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions. | ||||
| CVE-2026-66583 | 2026-08-20 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. | ||||
| CVE-2026-74021 | 2026-08-20 | 7.5 High | ||
| Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. | ||||
| CVE-2026-77084 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value. | ||||
| CVE-2026-77082 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker. | ||||
| CVE-2026-77081 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can thereby send a domain-restricted credential to an attacker-controlled endpoint, exfiltrating it with the leaked credential's permissions. | ||||
| CVE-2026-77080 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one. | ||||
| CVE-2026-77079 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to. | ||||
| CVE-2026-77076 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data. | ||||
| CVE-2026-77075 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution). | ||||
| CVE-2026-77074 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files. | ||||