CLEANSTART-2026-WQ57652 node-csv is a full-featured CSV parser with a simple API that is tested against large datasets

Security vulnerability affects the n8n package. node-csv is a full-featured CSV parser with a simple API that is tested against large datasets...

CLEANSTART-2026-US61275 fast-uri is a URI parser for Node

Security vulnerability affects the n8n package. fast-uri is a URI parser for Node...

CLEANSTART-2026-VM09695 toml-node is a TOML parser for Node

Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...

CLEANSTART-2026-SV74760 vm2 is an open source vm/sandbox for Node

Security vulnerability affects the n8n package. vm2 is an open source vm/sandbox for Node...

CLEANSTART-2026-GB44071 toml-node is a TOML parser for Node

Security vulnerability affects the n8n package. toml-node is a TOML parser for Node...

CLEANSTART-2026-RL65509 vm2 is a sandbox for running untrusted Node

Security vulnerability affects the n8n package. vm2 is a sandbox for running untrusted Node...

MAL-2026-17864 Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

MAL-2026-17865 Malicious code in passwordcrackv2 (npm)

passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

GHSA-H246-WPGF-VMQ5 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session OTP step-up requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a J...

GHSA-32GC-WF3M-78W9 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials. The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the token field. That sa...

CVE-2026-107811

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-107813 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-107811 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-107811

The Nginx UI web interface for the Nginx web server is vulnerable in versions 2.0.0 through 2.5.0 . Authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which serialize and leak the node token field. An attacker can use this token as the X-Node-Secret header to bypass authe...

EUVD-2026-95895

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-107805

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: kaf, kuberay-operator, nuclio-controller, argo-cd, kubedock-fips, mongodb-kubernetes, crossplane-provider-aws-ec2-fips, chainctl, crossplane-provider-gcp-beta-compute-fips, seaweedfs-fips, crossplane-provider-aws-sagemaker, kubernetes-csi-driver-smb,...