CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

SUSE CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-75926

Hugo 0.162.0–0.164.x added tailwindcss to the default security.exec.allow list, causing nodePermissionArgs to append --allow-child-process. A malicious tailwind.config.js executes top-level code inside the permitted Node process, calls child_process to spawn a shell, and the spawned non-Node proc...

CVE-2026-72194

A flaw was found in the Linux kernel's NTFS3 filesystem driver. A local attacker could craft a malicious NTFS image with circular index node references. When this filesystem is mounted and a specific file is deleted, it can trigger unbounded recursion in the indxfindbuffer function, leading to a...

CVE-2026-71539

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

EUVD-2026-60944

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

CVE-2026-71539 n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

CVE-2026-71539

In n8n, an authenticated user can exploit a race condition in the Git node clone operation to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart, enabling remote code execution...

CVE-2026-71539 n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

CVE-2026-71539

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

EUVD-2026-60943

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

GO-2026-6106 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve...

GO-2026-6129 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption in github.com/fission/fission

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAPSYSTIME and cross-tenant node wall-clock corruption in github.com/fission/fission...

GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...

PT-2026-80352

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve...

CVE-2026-71539: Time-of-check Time-of-use (TOCTOU) Race Condition

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

CVE-2026-32657: UNIX Symbolic Link (Symlink) Following

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version 4.5.4, Dell PowerFlex Intelligent Catalog Versions 46.377.00 and 46.382.00 and Dell PowerFlex...

PT-2026-77236

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

PT-2026-80374

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP SYS TIME and cross-tenant node wall-clock corruption in github.com/fission/fission...