n8n n8n

productDE

cpe:/a:n8n:n8n:-

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

6critical7high8medium0low

updated 2026-10-28

vulnerabilities (27)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-27577US	critical9.9	10.7% (96th)	Exploit	no fix	2026-02-25	—
CVE-2026-27495US	critical9.9	0.79% (56th)	Exploit	no fix	2026-02-25	—
CVE-2026-1470US	—	20.4% (97th)	—	no fix	2026-01-27	—
CVE-2026-0863US	critical9.9	9.29% (95th)	—	no fix	2026-01-18	—
CVE-2026-27493US	critical9.0	1.39% (72nd)	—	no fix	2026-02-25	—
CVE-2026-33660US	high8.8	0.97% (62nd)	—	no fix	2026-03-25	—
CVE-2026-27497US	high8.8	0.88% (59th)	—	no fix	2026-02-25	—
CVE-2026-27498US	high8.8	0.82% (57th)	—	no fix	2026-02-25	—
CVE-2026-33696US	high8.8	0.80% (57th)	—	no fix	2026-03-25	—
CVE-2026-56349US	—	0.47% (41st)	—	no fix	2026-07-15	—
CVE-2026-27494US	critical9.9	0.41% (35th)	—	no fix	2026-02-25	—
CVE-2026-33663US	medium6.5	0.40% (34th)	—	no fix	2026-03-25	—
CVE-2026-56350US	high7.7	0.38% (32nd)	—	no fix	2026-06-30	—
CVE-2026-33665US	high7.5	0.33% (26th)	—	no fix	2026-03-25	—
CVE-2026-56353US	—	0.33% (26th)	—	no fix	2026-07-15	—
CVE-2026-56357US	medium5.3	0.31% (24th)	—	no fix	2026-06-22	—
CVE-2026-56360US	—	0.31% (24th)	—	no fix	2026-07-08	—
CVE-2026-33724US	high7.4	0.29% (22nd)	—	no fix	2026-03-25	—
CVE-2026-27496US	medium6.5	0.27% (19th)	—	no fix	2026-03-25	—
CVE-2026-33722US	medium5.3OT elevated	0.27% (18th)	—	no fix	2026-03-25	—
CVE-2026-33749US	critical9.0	0.25% (17th)	—	no fix	2026-03-25	—
CVE-2026-56356US	—	0.25% (16th)	—	no fix	2026-06-30	—
CVE-2026-33751US	medium4.8	0.25% (16th)	—	no fix	2026-03-25	—
CVE-2026-56359US	—	0.24% (15th)	—	no fix	2026-07-08	—
CVE-2026-56354US	medium5.4	0.24% (15th)	—	no fix	2026-07-10	—
CVE-2026-27578US	medium5.4	0.22% (12th)	—	no fix	2026-02-25	—
CVE-2026-33720US	medium4.2OT elevated	0.18% (8th)	—	no fix	2026-03-25	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-94Improper Control of Generation of Code ('Code Injection')7 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-287Improper Authentication3 CVEs
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')3 CVEs
CWE-290Authentication Bypass by Spoofing2 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)27 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan