Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 177
Reset filtersn8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
n8n has XML Node Prototype Pollution that to RCE
n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
n8n Vulnerable to XSS via MCP OAuth client
n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
n8n has a Python Task Runner Sandbox Escape Vulnerability
n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
n8n Vulnerable to Hijacking of Unauthenticated Chat Execution
n8n has SQL Injection in SeaTable Node
n8n has Open Redirect in MCP OAuth Consent Flow
n8n has SQL Injection in Oracle Database Node via Limit Field
n8n has SQL Injection in Snowflake and MySQL Nodes
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
n8n-mcp has unauthenticated session termination and information disclosure in HTTP transport
n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode
n8n has XSS in its Credential Management Flow
n8n has XSS in Chat Trigger Node through Custom CSS
n8n: Authenticated XSS and Open Redirect via Form Node
n8n has a Stored XSS Vulnerability in its Form Trigger
n8n Vulnerable to LDAP Filter Injection in LDAP Node
n8n Vulnerable to XSS via Binary Data Inline HTML Rendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.