Vendor security profile1 actively exploited CVEs

n8n

Product portfolio, patch evidence and exploitation signals in a single security scorecard

The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.Scope: all CVE records matched to the company · Source evidence is on each CVE's page

Total CVEs114

Critical4

CISA KEV1

Public exploit2

Patch rate%18

Avg. CVSS6.8

12-month vulnerability rate

CVEs published, and the CISA KEV records among them

Kas

Ara

Oca

Şub

Mar

Nis

May

Haz

Tem

Ağu

Eyl

Eki

CVE KEV

CVE severity distribution

The company's whole portfolio of recorded CVEs

114toplam CVE

Critical4 (4%)

High52 (46%)

Medium57 (50%)

Low1 (1%)

Patch and exploitation view

Patch evidence, public exploits and active exploitation signals together

%18

Verified patch

21 records

CISA KEV

1 records

Public exploit

2 records

21Patch available

0Partial

0Workaround

0Vendor: no patch

93Unknown

Latest vulnerabilities

The 10 newest records · metrics are calculated over the whole period

View all

6.3

CVE-2026-103260

n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

8.5

CVE-2026-103259

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

6.9

CVE-2026-103258

n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

8.1

CVE-2026-103257

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

7.1

CVE-2026-103256

n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

7.1

CVE-2026-103255

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

7.0

CVE-2026-103254

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

7.0

CVE-2026-103253

n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

7.1

CVE-2026-103252

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

7.5

CVE-2026-103251

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

Vendorn8n-ioProductn8n

Patch status unknownEPSS %011 d ago

n8n

12-month vulnerability rate

CVE severity distribution

Patch and exploitation view

Latest vulnerabilities

n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration