Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 177
Reset filtersn8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
n8n: Microsoft SQL Node Prototype Pollution
n8n: Merge Node SQL Mode Prototype Pollution
n8n: Prototype Pollution enables confused-deputy execution via public webhooks
n8n: Same-Origin XSS in Respond to Webhook Node
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
n8n: Git Node Clone and Push Operations Bypass File Sandbox
n8n: Python sandbox escape
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions
n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete
n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
n8n Has a Source Control Pull SQL Injection
n8n Has an XML Node Prototype Pollution Patch Bypass
n8n Has an Arbitrary File Read via Git Node
n8n: HTTP Request Node Pagination Prototype Pollution to RCE
n8n-mcp affected by path traversal, redirect-following SSRF, and telemetry payload exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.