PT-2026-75042

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1...

PT-2026-75528

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.2...

PT-2026-74104

TuxCare rebuilt ua-parser-js to address 3 CVEs. Fixed in 0.7.21-tuxcare.1...

PT-2026-73949

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.1.1-tuxcare.1...

PT-2026-74038

TuxCare rebuilt crypto-js to address 1 CVE. Fixed in 3.3.0-tuxcare.1...

PT-2026-74036

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.3.1-tuxcare.1...

PT-2026-67914

Finding — Unauthorized Workspace Variables disclosure via $vars injection bypasses variables:view What’s wrong code locations - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables...

PT-2026-75585

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.2-tuxcare.1...

PT-2026-74060

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.3.6-tuxcare.1...

PT-2026-74059

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.3.5-tuxcare.1...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview @cacheable/node-cache is a Simple and Maintained fast NodeJS internal caching Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular cachi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Important: Red Hat Security Advisory: Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 9 : nodejs:24 (RHSA-2026:47057)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47057 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

OESA-2026-3212 nodejs-websocket-driver security update

. Security Fixes: websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By...

Injection js-cookie Dependency in Crowd Data Center

This High severity Injection vulnerability was introduced in versions 6.0.0, 6.1.0, 6.2.0, 6.3.6, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated attack...