https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 19:02:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118641 <p>n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox&#39;s entire contact list or redirect SharePoint writes onto unintended list items within the stored credential&#39;s scope.</p> <p>n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox&#39;s entire contact list or redirect SharePoint writes onto unintended list items within the stored credential&#39;s scope.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118641 https://db.gcve.eu/vuln/ghsa-rvxx-r8h9-hc4w <p>n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox&#39;s entire contact list or redirect SharePoint writes onto unintended list items within the stored credential&#39;s scope.</p> <p>n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers who supply untrusted input to such workflows can inject single quotes to dump the bound mailbox&#39;s entire contact list or redirect SharePoint writes onto unintended list items within the stored credential&#39;s scope.</p> https://db.gcve.eu/vuln/ghsa-rvxx-r8h9-hc4w