CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

CVE-2026-73410

Budibase versions prior to 3.40.0 have a DNS-rebinding SSRF flaw in the REST datasource integration. The guard fetchWithBlacklist pins a validated IP via a Node http(s).Agent, but rest.ts routes requests through undici's fetch, which silently ignores the agent option and uses its own dispatcher t...

ANT-2026-6JWE6ZK7 · langchain-ai/deepagentsjs · sandbox_escape

other high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-6JWE6ZK7: VFS sandbox executes agent commands directly on host T...

ROOT-APP-NPM-AIKIDO-2026-554041 AIKIDO-2026-554041 in crypto-js - Patched by Root

Root has patched AIKIDO-2026-554041 in the crypto-js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27980 CVE-2026-27980 in next - Patched by Root

Root has patched CVE-2026-27980 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27977 CVE-2026-27977 in next - Patched by Root

Root has patched CVE-2026-27977 in the next package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview epic-common-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-19970

A flaw was found in Open Asset Import Library Assimp. A heap-based buffer overflow vulnerability exists in the AddBonesToNodeGraph3DGSMDL7 function within the Node Parser component. This flaw can be triggered remotely by manipulating the bonesnum argument. Successful exploitation could lead to...

DEBIAN-CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

UBUNTU-CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970 Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970 Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

EUVD-2026-60021

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970: Heap-based Buffer Overflow

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-35219: Server-Side Request Forgery (SSRF)

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

nodejs22 security update

1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219 1:22.23.1-6 - Fix for CVE-2026-69152 1:22.23.1-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:22.23.1-4 - Fix CVE-2026-13149 npm/brace-expansion 1:22.23.1-3 - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 node-tar...