{"vulnerability": "cve-2026-6559", "sightings": [{"uuid": "65766904-aeb1-43d0-aefb-7b52a0d85d3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6559", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjtogghh3o2c", "content": "", "creation_timestamp": "2026-04-19T09:49:23.771838Z"}, {"uuid": "a0f9b0ad-ff4d-41b3-9781-5a15f24c2af1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65592", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrwxt62c7x2m", "content": "\ud83d\udccc CVE-2026-65592 - n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the w... https://www.cyberhub.blog/cves/CVE-2026-65592", "creation_timestamp": "2026-07-31T12:37:06.984401Z"}, {"uuid": "d312e64e-20b7-452f-a04e-f5429bdefffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65597", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrxkbab4su23", "content": "\ud83d\udccc CVE-2026-65597 - n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders e... https://www.cyberhub.blog/cves/CVE-2026-65597", "creation_timestamp": "2026-07-31T18:07:06.368984Z"}, {"uuid": "f8ed41e5-472e-4f64-8b4d-4d70329773d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65591", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mradujhba52i", "content": "CVE-2026-65591 - n8n before 1.123.64 Sanitizer Bypass Remote Code Execution\nCVE ID : CVE-2026-65591\n \n Published : July 22, 2026, 12:18 p.m. | 18\u00a0minutes ago\n \n Description : n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member han...", "creation_timestamp": "2026-07-22T12:41:23.275611Z"}, {"uuid": "48b9c500-e8f4-4b69-ba4a-4ea0b87b57de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65595", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrae3aqpxo27", "content": "CVE-2026-65595 - n8n before 2.30.1 Privilege Escalation via Token Exchange\nCVE ID : CVE-2026-65595\n \n Published : July 22, 2026, 12:18 p.m. | 18\u00a0minutes ago\n \n Description : n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchang...", "creation_timestamp": "2026-07-22T12:45:09.128624Z"}, {"uuid": "1e0dd867-b915-4be9-8325-62fb58b2bd9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65592", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mraecwcu452i", "content": "CVE-2026-65592 - n8n before 1.123.64 Stored DOM XSS via cachedResultUrl\nCVE ID : CVE-2026-65592\n \n Published : July 22, 2026, 12:18 p.m. | 18\u00a0minutes ago\n \n Description : n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Re...", "creation_timestamp": "2026-07-22T12:49:26.576421Z"}, {"uuid": "d7bfcf59-b4eb-4509-9df6-141378adca26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65597", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mraelut7k22e", "content": "CVE-2026-65597 - n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe\nCVE ID : CVE-2026-65597\n \n Published : July 22, 2026, 12:18 p.m. | 18\u00a0minutes ago\n \n Description : n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vuln...", "creation_timestamp": "2026-07-22T12:54:27.163105Z"}, {"uuid": "b868d880-bb91-43ed-9a3d-973addc15989", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65598", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mraf5rtpf62i", "content": "CVE-2026-65598 - n8n before 1.123.64 Remote Code Execution via Git Clone\nCVE ID : CVE-2026-65598\n \n Published : July 22, 2026, 12:18 p.m. | 18\u00a0minutes ago\n \n Description : n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operatio...", "creation_timestamp": "2026-07-22T13:04:28.057193Z"}, {"uuid": "c09c8a6a-394e-475c-a0e4-3309b5ace6a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65592", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mramfmee6z2e", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-65592](https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q)\nn8n befor...\nhttps://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q #CVE #ZeroDay #PatchManagement", "creation_timestamp": "2026-07-22T15:14:06.857864Z"}, {"uuid": "548415f8-feb9-423d-b969-4d03cfad1c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65595", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrbf7iffpq2j", "content": "CVE-2026-65595 - n8n\nA low-privileged user can gain elevated access to n8n's Public API, potentially allowing them to create, delete, or escalate user roles. This can happen if a malicious user obtains a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#n8n #n8nio #npm #CVE #infosec", "creation_timestamp": "2026-07-22T22:38:04.648763Z"}, {"uuid": "9d94c934-c4cf-4ab7-8856-9cdb13d13562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65591", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrbfd2xbsj2z", "content": "CVE-2026-65591 - n8n\nAn attacker with workflow editing permissions can run malicious code on the server where n8n is installed. This can happen if the server is not updated to version 1.123.64 or later.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#n8n #n8nio #npm #CVE #infosec", "creation_timestamp": "2026-07-22T22:40:04.949101Z"}, {"uuid": "ee3dfbcf-37b0-477f-a69b-3ccb543a13db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65591", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmdahelz2n", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-65591](https://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g)\nn8n conta...\nhttps://github.com/n8n-io/n8n/security/advisories/GHSA-pm35-fqvh-cq5g #Vulnerability #CVE #ZeroDay", "creation_timestamp": "2026-07-27T19:17:24.134098Z"}, {"uuid": "200df2ce-de3d-4b4d-8042-b2a0b081c437", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65598", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrq2k4jcre22", "content": "\ud83d\udccc CVE-2026-65598 - n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass p... https://www.cyberhub.blog/cves/CVE-2026-65598", "creation_timestamp": "2026-07-28T18:37:06.689941Z"}, {"uuid": "2d36c885-ec5d-470c-9546-3362085a488c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-65595", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrq5vfeidp23", "content": "\ud83d\udccc CVE-2026-65595 - n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. ... https://www.cyberhub.blog/cves/CVE-2026-65595", "creation_timestamp": "2026-07-28T19:37:06.898066Z"}]}