n8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42227 · GHSA-756q-gq9h-fp22 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
7276–7300 of 31,057 matching · newest first
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42227 · GHSA-756q-gq9h-fp22 · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42236 · GHSA-49m9-pgww-9vq6 · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42228 · GHSA-f77h-j2v7-g6mw · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42229 · GHSA-mp4j-h6gh-f6mp · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42230 · GHSA-f6x8-65q6-j9m9 · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42233 · GHSA-r6jc-mpqw-m755 · amended
npm n8n · Upgrade to 2.18.1, 2.17.4 or 1.123.32 by release line · < 1.123.32; >= 2.18.0, < 2.18.1; >= 2.0.0, < 2.17.4 · CVE-2026-42237 · GHSA-hp3c-vfpm-q4f7 · amended
Packagist ipl/web · Upgrade to 0.13.1 or 0.10.3 by release line · >= 0.11.0, <= 0.13.0; <= 0.10.2 · CVE-2026-42224 · GHSA-55wf-5m3q-6jjf
Maven com.appsmith:interfaces · Upgrade to 1.99 or later · <= 1.98 · GHSA-h8cj-hpmg-636v
Packagist roadiz/openid · Upgrade to 2.7.18, 2.6.31, 2.5.45 or 2.3.43 by release line · >= 2.7.0, < 2.7.18; >= 2.6.0, < 2.6.31; >= 2.5.0, < 2.5.45; < 2.3.43 · CVE-2026-42206 · GHSA-3gx8-q682-38mx
Go github.com/osrg/gobgp/v4 · Upgrade to 4.3.0 or later · <= 4.2.0 · CVE-2026-41643 · GHSA-8rxh-r2p6-7f2q
Go github.com/osrg/gobgp/v4 · Upgrade to 4.4.0 or later · >= 4.3.0, <= 4.3.0 · CVE-2026-41642 · GHSA-7235-89m6-f4px
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.7.0 or later · >= 0.26.0.0, <= 0.31.6.0 · CVE-2026-41587 · GHSA-fw49-9xq4-gmx6
PyPI ckan · Upgrade to 2.11.5 or 2.10.10 by release line · >= 2.10.0, < 2.10.10; >= 2.11.0, <= 2.11.4 · CVE-2026-41255 · GHSA-mcvf-jxcw-vj73 · amended
PyPI ckan · Upgrade to 2.11.5 or 2.10.10 by release line · >= 2.11.0, <= 2.11.4; < 2.10.10 · CVE-2026-41132 · GHSA-mpfm-fpgx-647q · amended
Packagist phpoffice/phpspreadsheet · Upgrade to 5.7.0, 3.10.5, 2.4.5 or 2 more by release line · >= 4.0.0, <= 5.6.0; >= 3.3.0, <= 3.10.4; >= 2.2.0, <= 2.4.4; >= 2.0.0, <= 2.1.15; <= 1.30.3 · CVE-2026-40902 · GHSA-7c6m-4442-2x6m
Packagist phpoffice/phpspreadsheet · Upgrade to 5.7.0, 3.10.5, 2.4.5 or 2 more by release line · >= 4.0.0, < 5.7.0; >= 3.3.0, < 3.10.5; >= 2.2.0, < 2.4.5; >= 2.0.0, < 2.1.16; < 1.30.6 · CVE-2026-40863 · GHSA-84wq-86v6-x5j6 · amended
Packagist phpoffice/phpspreadsheet · Upgrade to 5.6.0, 3.10.4, 2.4.4 or 2 more by release line · >= 4.0.0, <= 5.5.0; >= 3.3.0, <= 3.10.3; >= 2.2.0, <= 2.4.3; >= 2.0.0, <= 2.1.14; <= 1.30.2 · CVE-2026-34084 · GHSA-q4q6-r8wh-5cgh
NuGet opentelemetry.exporter.onecollector · Upgrade to 1.15.1 or later · <= 1.15.0 · CVE-2026-41484 · GHSA-55m9-299j-53c7
Packagist cockpit-hq/cockpit · Upgrade to 2.14.0 or later · < 2.14.0 · CVE-2026-38993 · GHSA-p46p-7pmj-m34f
Packagist cockpit-hq/cockpit · Upgrade to 2.14.0 or later · < 2.14.0 · CVE-2026-38991 · GHSA-j2rx-4jg9-79mw
NuGet opentelemetry.resources.azure · Upgrade to 1.15.1-beta.1 (pre-release) or later · <= 1.15.0-beta.1 · CVE-2026-41483 · GHSA-vc24-j8c5-2vw4
PyPI beets · Upgrade to 2.10.0 or later · < 2.10.0 · CVE-2026-42052 · GHSA-3gxm-wfjx-m847 · amended
Maven org.jenkins-ci.plugins:htmlpublisher · Upgrade to 427.1 or later · < 427.1 · CVE-2026-42524 · GHSA-f8h4-46xv-h7jj
Maven org.jenkins-ci.plugins:azure-ad · Upgrade to 667.v4c5827a (pre-release) or later · <= 666.v6060de32f87d · CVE-2026-42525 · GHSA-jp6g-g3v3-6gvf
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.