SQL Injection

Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.

1. n8n before 1.123.69 PostgREST Filter Injection via SupabaseCVE-2026-77071n8n-io · CVSS 7.1 · 0.6% likely

   CWE-89

2. n8n: SQL Injection in Postgres v1/TimesclaeDB NodesCVE-2026-54310n8n-io · CVSS 6.5 · 0.5% likely

   CWE-89

3. n8n before 1.123.69 NoSQL Injection via MongoDB NodeCVE-2026-77070n8n-io · CVSS 7.1 · 0.5% likely

   CWE-943

4. n8n before 1.123.67 SQL Injection via PostgresTrigger NodeCVE-2026-72775n8n-io · CVSS 5.8 · 0.5% likely

   CWE-89

5. n8n before 1.123.67 SQL Injection via executeQuery OperationCVE-2026-72750n8n-io · CVSS 5.3 · 0.5% likely

   CWE-89

6. n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn ExpressionCVE-2026-33713n8n-io · CVSS 8.7 · 0.4% likely

   CWE-89

7. n8n before 2.36.2 Query Injection via Elasticsearch Firestore NodesCVE-2026-85167n8n-io · CVSS 6.3 · 0.4% likely

   CWE-943

8. n8n: Source Control Pull SQL InjectionCVE-2026-44792n8n-io · CVSS 8.9 · 0.4% likely

   CWE-89

9. n8n before 1.123.89 NoSQL Injection via MongoDB Node Update KeyCVE-2026-126383n8n-io · CVSS 8.2 · 0.3% likely

   CWE-943

10. n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter KeyCVE-2026-126381n8n-io · CVSS 6.3 · 0.3% likely

    CWE-89

11. n8n: NoSQL Injection in MongoDB Node Find And Replace OperationCVE-2026-54313n8n-io · CVSS 6.5 · 0.3% likely

    CWE-89

12. n8n: SQL Injection in SeaTable NodeCVE-2026-42229n8n-io · CVSS 5.3 · 0.3% likely

    CWE-89

13. n8n: SQL Injection in Oracle Database Node via Limit FieldCVE-2026-42233n8n-io · CVSS 5.3 · 0.3% likely

    CWE-89

14. n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter InterpolationCVE-2026-103258n8n-io · CVSS 6.8 · 0.3% likely

    CWE-943

15. n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via SupabaseCVE-2026-103248n8n-io · CVSS 9 · 0.3% likely

    CWE-89

16. n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint NodesCVE-2026-118641n8n-io · CVSS 7.5 · 0.3% likely

    CWE-943

17. n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query FieldCVE-2026-110840n8n-io · CVSS 7 · 0.3% likely

    CWE-89

18. n8n: SQL Injection in Snowflake and MySQL NodesCVE-2026-42237n8n-io · CVSS 5.3 · 0.3% likely

    CWE-89

19. n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop TableCVE-2026-103253n8n-io · CVSS 8.7 · 0.2% likely

    CWE-89

20. n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where ParameterCVE-2026-118645n8n-io · CVSS 8.7 · 0.2% likely

    CWE-943

21. n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat MemoryCVE-2026-103250n8n-io · CVSS 8.1 · 0.2% likely

    CWE-943

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.