CVE Vulnerability Database
Search and browse 425,078 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-103257 | HIGH | 7.7 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi... |
| CVE-2026-103256 | HIGH | 7.1 | — | Oct 1, 2026 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow us... |
| CVE-2026-103255 | CRITICAL | 9 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi... |
| CVE-2026-103254 | MEDIUM | 6.3 | 0.3% | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerabi... |
| CVE-2026-103253 | HIGH | 8.7 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerabi... |
| CVE-2026-103252 | HIGH | 7.7 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vu... |
| CVE-2026-103251 | HIGH | 7.1 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulner... |
| CVE-2026-103250 | HIGH | 8.1 | 0.2% | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerab... |
| CVE-2026-103249 | HIGH | 7.6 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site sc... |
| CVE-2026-103248 | CRITICAL | 9 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnera... |
| CVE-2026-103247 | HIGH | 8.5 | — | Oct 1, 2026 | n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow c... |
| CVE-2026-103246 | HIGH | 7.7 | 0.3% | Oct 1, 2026 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool ... |
| CVE-2026-103245 | MEDIUM | 5.3 | — | Oct 1, 2026 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signa... |
| CVE-2026-103244 | CRITICAL | 9.8 | — | Oct 1, 2026 | ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that al... |
| CVE-2026-103082 | HIGH | 7.2 | — | Oct 1, 2026 | Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit a... |
| CVE-2026-96577 | HIGH | 7.1 | 0.1% | Oct 1, 2026 | A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network inter... |
| CVE-2026-96256 | MEDIUM | 6.4 | 0.3% | Oct 1, 2026 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stor... |
| CVE-2026-92144 | HIGH | 7.2 | — | Oct 1, 2026 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro... |
| CVE-2026-83589 | MEDIUM | 6.1 | 0.4% | Oct 1, 2026 | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) du... |
| CVE-2026-7176 | MEDIUM | 4.8 | — | Oct 1, 2026 | CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit dur... |
| CVE-2026-7175 | MEDIUM | 4.8 | — | Oct 1, 2026 | CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s pro... |
| CVE-2026-7174 | MEDIUM | 4.8 | — | Oct 1, 2026 | CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and F... |
| CVE-2026-7173 | MEDIUM | 4.8 | — | Oct 1, 2026 | CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability cou... |
| CVE-2026-75786 | HIGH | 7.2 | — | Oct 1, 2026 | Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL inje... |
| CVE-2026-64950 | HIGH | 8.4 | — | Oct 1, 2026 | Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows s... |