PT-2026-74156

TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.7.0-tuxcare.1...

PT-2026-75535

TuxCare rebuilt ua-parser-js to address 2 CVEs. Fixed in 0.7.22-tuxcare.1...

PT-2026-75597

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.1-tuxcare.2...

PT-2026-75132

TuxCare rebuilt js-cookie to address 1 CVE. Fixed in 2.2.1-tuxcare.1...

PT-2026-75514

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.1.0-tuxcare.2...

PT-2026-74551

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 3.4.10-tuxcare.1...

PT-2026-74548

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.8.29-tuxcare.1...

PT-2026-75203

TuxCare rebuilt ua-parser-js to address 1 CVE. Fixed in 0.7.31-tuxcare.1...

PT-2026-75042

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1...

PT-2026-74758

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.1.0-tuxcare.1...

PT-2026-75528

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.2...

PT-2026-74104

TuxCare rebuilt ua-parser-js to address 3 CVEs. Fixed in 0.7.21-tuxcare.1...

PT-2026-73949

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.1.1-tuxcare.1...

PT-2026-74038

TuxCare rebuilt crypto-js to address 1 CVE. Fixed in 3.3.0-tuxcare.1...

PT-2026-74036

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.3.1-tuxcare.1...

PT-2026-67914

Finding — Unauthorized Workspace Variables disclosure via $vars injection bypasses variables:view What’s wrong code locations - Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932 - Runtime variables...

PT-2026-75585

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.2-tuxcare.1...

PT-2026-74060

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.3.6-tuxcare.1...

PT-2026-74059

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.3.5-tuxcare.1...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...