266122 matches found
CVE-2026-89259 Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...
CVE-2026-89259
Hugo , a static site generator, introduced Node's permission model in v0.161.0 to restrict tools executed during builds. However, TailwindCSS — present in the default security.exec.allow list — requires highly permissive flags (--allow-addons, --allow-child-process, --allow-worker), effectively b...
ROOT-APP-NPM-CVE-2022-46175 CVE-2022-46175 in json5 - Patched by Root
Root has patched CVE-2022-46175 in the json5 package for Root:npm. Multiple fixed versions available...
PT-2026-90460
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the device property handling where the fwnode for each child node function can enter an infinite loop. This occurs when iterating over children of a fwnode that...
PT-2026-89862
Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...
Linux Distros Unpatched Vulnerability : CVE-2026-89259
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS included in the default...
Linux Distros Unpatched Vulnerability : CVE-2026-87090
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another...
tar: node-tar: Denial of Service via crafted gzip bomb
A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...
tar: Node-tar: Denial of Service via malformed tar archive header
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...
GHSA-QGPW-8G46-W95V n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...
NPM: n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
NPM: n8n: Git Node branch..remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
EUVD-2026-74268
n8n: Git Node branch..remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read...
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...
GHSA-F2CP-M7MV-8JPV n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
Impact The Elasticsearch and ElasticSecurity nodes built REST endpoints by interpolating user-provided identifiers straight into the request path. A value containing path separators or dot segments changed which endpoint the request actually reached, so an operation intended for one document coul...
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
Impact The Elasticsearch and ElasticSecurity nodes built REST endpoints by interpolating user-provided identifiers straight into the request path. A value containing path separators or dot segments changed which endpoint the request actually reached, so an operation intended for one document coul...
NPM: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
NPM: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
EUVD-2026-74277
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers...
Security Bulletin: Consul vulnerable to an authorization bypass in the catalog node-write path
Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any sing...
CVE-2026-87090
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...
CVE-2026-88058
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...