Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
105,412 matching · page 14/2109Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-76988(opens NVD record) | Medium | 5.3 | A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument product_code_ can lead to out-of-bounds read. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ea870a274bf68dfaa3f511f20e2fff6778fb7b74. A patch should be applied to remediate this issue. | Aug 20, 2026 |
| CVE-2026-76987(opens NVD record) | High | 7.3 | A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is named e745d9d4a8ca3a13689066983a1269fe1e567674. It is suggested to install a patch to address this issue. | Aug 20, 2026 |
| CVE-2026-74011(opens NVD record) | High | 7.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9. | Aug 20, 2026 |
| CVE-2026-28164(opens NVD record) | Critical | 9.6 | Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7. | Aug 20, 2026 |
| CVE-2026-28163(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8. | Aug 20, 2026 |
| CVE-2026-21784(opens NVD record) | Medium | 4.8 | HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation. | Aug 20, 2026 |
| CVE-2026-18482(opens NVD record) | Unscored | — | Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities. | Aug 20, 2026 |
| CVE-2025-62306(opens NVD record) | Medium | 5.0 | HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response. | Aug 20, 2026 |
| CVE-2025-62300(opens NVD record) | Medium | 5.9 | HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | Aug 20, 2026 |
| CVE-2025-62299(opens NVD record) | Medium | 6.6 | HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | Aug 20, 2026 |
| CVE-2026-77085(opens NVD record) | Unscored | — | n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8N_SSRF_PROTECTION_ENABLED=true, an authenticated user with permission to create SearXNG credentials and configure a personal agent could set the API URL to an internal host, causing the n8n server to connect to that host and return the response content through the Agent chat output. | Aug 20, 2026 |
| CVE-2026-77084(opens NVD record) | Unscored | — | n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value. | Aug 20, 2026 |
| CVE-2026-77083(opens NVD record) | Unscored | — | n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node execution and recover a reference to the host's globalThis, resulting in a sandbox escape. The full exploit chain additionally depends on specific modules being available as allowlisted imports in the deployment's configuration. The issue is fixed in versions 1.123.69, 2.33.4, and 2.34.1. | Aug 20, 2026 |
| CVE-2026-77082(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker. | Aug 20, 2026 |
| CVE-2026-77081(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can thereby send a domain-restricted credential to an attacker-controlled endpoint, exfiltrating it with the leaked credential's permissions. | Aug 20, 2026 |
| CVE-2026-77080(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions. An authenticated user with usable Snowflake credentials can upload a local file from the n8n host or overwrite an existing file with a staged one. | Aug 20, 2026 |
| CVE-2026-77079(opens NVD record) | Unscored | — | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, performing no project-level authorization check. A user holding only the narrow role:manageProject global scope could delete any custom project role in use on the instance and reassign its holders (including themselves) to the built-in project:admin role, gaining full administrative control of projects they had no legitimate access to. | Aug 20, 2026 |
| CVE-2026-77077(opens NVD record) | Unscored | — | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit prototype pollution to execute arbitrary commands within the runner container. Because the polluted prototype is a process-wide object, the corruption persists across other tenants' Code node executions on the same shared runner. On v1.x instances without task runners enabled, Code node JavaScript runs directly in the main n8n process, where the impact could be higher. | Aug 20, 2026 |
| CVE-2026-77076(opens NVD record) | Unscored | — | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data. | Aug 20, 2026 |
| CVE-2026-77075(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An authenticated member can store a malicious value so that when another user opens the affected node in the editor, the injected expression is evaluated as JavaScript in the victim's authenticated session (cross-user script execution). | Aug 20, 2026 |
| CVE-2026-77074(opens NVD record) | Unscored | — | n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access local files. | Aug 20, 2026 |
| CVE-2026-77073(opens NVD record) | Unscored | — | n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references on workflows in different projects. | Aug 20, 2026 |
| CVE-2026-77072(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Any visitor who submitted the resulting public form would have that script execute same-origin with their session. | Aug 20, 2026 |
| CVE-2026-77071(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification. | Aug 20, 2026 |
| CVE-2026-77070(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query (e.g., via externally-controlled data) can inject operators such as $ne or $where, turning an intended single-document lookup into full-collection disclosure, full-collection deletion, or other operations on the database server. | Aug 20, 2026 |
| CVE-2026-77069(opens NVD record) | Unscored | — | n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no SSRF guard. A user with credential-creation permissions can set the access-token URL to an internal address and complete the OAuth2 flow, causing n8n to send a fixed-shape token-exchange POST to that target and reflect its response body back to the attacker (limited to what the target returns to this specific request). | Aug 20, 2026 |
| CVE-2026-77068(opens NVD record) | Unscored | — | n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating path-traversal sequences. An authenticated user with global:member privileges can reference malicious files via path traversal, causing code execution in the n8n main process. | Aug 20, 2026 |
| CVE-2026-74021(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. | Aug 20, 2026 |
| CVE-2026-74020(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | Aug 20, 2026 |
| CVE-2026-74019(opens NVD record) | High | 7.1 | Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. | Aug 20, 2026 |
| CVE-2026-74018(opens NVD record) | Critical | 9.9 | Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. | Aug 20, 2026 |
| CVE-2026-74016(opens NVD record) | Critical | 9.9 | Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. | Aug 20, 2026 |
| CVE-2026-74014(opens NVD record) | Critical | 9.9 | Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. | Aug 20, 2026 |
| CVE-2026-74013(opens NVD record) | High | 8.5 | Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. | Aug 20, 2026 |
| CVE-2026-74001(opens NVD record) | Critical | 9.8 | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. | Aug 20, 2026 |
| CVE-2026-73998(opens NVD record) | High | 8.5 | Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. | Aug 20, 2026 |
| CVE-2026-73993(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | Aug 20, 2026 |
| CVE-2026-73992(opens NVD record) | Critical | 9.9 | Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. | Aug 20, 2026 |
| CVE-2026-73402(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions. | Aug 20, 2026 |
| CVE-2026-68566(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. | Aug 20, 2026 |
| CVE-2026-68564(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. | Aug 20, 2026 |
| CVE-2026-66682(opens NVD record) | Critical | 9.8 | Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. | Aug 20, 2026 |
| CVE-2026-66680(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. | Aug 20, 2026 |
| CVE-2026-66677(opens NVD record) | High | 7.6 | Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | Aug 20, 2026 |
| CVE-2026-66673(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions. | Aug 20, 2026 |
| CVE-2026-66672(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. | Aug 20, 2026 |
| CVE-2026-66649(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. | Aug 20, 2026 |
| CVE-2026-66647(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Homlisti <= 3.1.2 versions. | Aug 20, 2026 |
| CVE-2026-66616(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions. | Aug 20, 2026 |
| CVE-2026-66615(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions. | Aug 20, 2026 |