DanSec

Vendor

n8n

In 17 briefs, most recently 6 August 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

1 n8n vulnerability is on CISA's list of vulnerabilities exploited in the wild. Most recent:

Coverage in DanSec Daily

  1. Oracle database hack via khunt toolkit, Snowflake data theft guilty plea, and actively exploited JetBrains TeamCity RCE.
  2. Coca-Cola's Fairlife data theft, Ernst & Young and Origin Energy breaches, and a FastJson zero-day exploited in the wild, plus Dysphoria botnet and Mirage …
  3. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  4. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  5. Malicious checkmarx/kics Docker images, a self-propagating npm worm stealing developer tokens, and Lotus Wiper attacks on Venezuela's energy sector.
  6. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  7. Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
  8. The SocksEscort proxy botnet takedown, Telus Digital and Loblaw breaches, and Veeam's seven critical Backup & Replication flaws.
  9. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  10. Spain's Ministry of Science IT outage, Conpet ransomware attack tied to Qilin, and Substack breach.
  11. Mexican government breach claim, Notepad++ update hijacking distributing a backdoor, and a critical n8n flaw allowing host takeover.
  12. The Match Group breach, SonicWall-linked ransomware hitting US banks and credit unions, and actively exploited Ivanti EPMM zero-days.
  13. The Polish energy grid cyberattack attributed to ELECTRUM, the eScan update server breach, and the FBI seizure of the RAMP cybercrime forum.
  14. Hackers selling Target source code, the n8n "Ni8mare" flaw hitting about 60,000 instances, and a Gogs zero-day under a CISA patch order.
  15. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  16. Brightspeed customer data claimed stolen by Crimson Collective, fake AITOPIA Chrome extensions harvesting AI chats, and critical n8n 'Ni8mare' RCE (CVSS 10.0).
  17. Brightspeed breach claimed by Crimson Collective, Zestix stealing data from ShareFile, Nextcloud and OwnCloud, and critical n8n and MongoDB flaws.