CLEANSTART-2026-YK40300 Prometheus is an open-source monitoring system and time series database

Security vulnerability affects the node-problem-detector package. Prometheus is an open-source monitoring system and time series database...

CLEANSTART-2026-IN42122 Security fix for GHSA-hrxh-6v49-42gf applied in: external-secrets-operator-fips 2.7.0-r1, node-problem-detector 0.8.25-r1

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-107805: Uncontrolled Resource Consumption

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated...

PT-2026-108965

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Ordinary authenticated users can access the /api/nodes and /api/nodes/:id endpoints, which return node objects containing a sensitive token field. This token is used as a shared credential for...

PT-2026-108959

Name of the Vulnerable Software and Affected Versions ruoyi-ai versions 3.0.0 through 3.1.0 Description An authorization flaw exists in the 'GET /workflow/search' endpoint. Authenticated users without administrative privileges can query this endpoint to list enabled private workflows within the...

PT-2026-109317

Name of the Vulnerable Software and Affected Versions Astron Agent versions prior to 1.1.2 Description An authenticated low-privilege tenant can execute arbitrary code as root within the core-workflow container. This occurs because the default workflow code-node path through the endpoints...

PT-2026-108934

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.5.0 through 2.5.x Description The node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it to disk before validating the body digest and cryptographic...

PT-2026-110788

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description Nginx UI fails to apply RequireSecureSession to several authenticated mutation routes. This occurs despite the requirement for users with One-Time Password OTP enabled to provide a fresh...

CVE-2026-107811: Exposure of Sensitive Information to an Unauthorized Actor

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser,...

CVE-2026-107813: Missing Authorization

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user...

AZL-107832 CVE-2026-97032 affecting package prometheus-node-exporter 1.7.0-5

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107826 CVE-2026-78669 affecting package prometheus-node-exporter 1.7.0-5

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107835 CVE-2026-78659 affecting package prometheus-node-exporter 1.7.0-5

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

AZL-107823 CVE-2026-78660 affecting package prometheus-node-exporter 1.7.0-5

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107829 CVE-2026-78663 affecting package prometheus-node-exporter 1.7.0-5

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

EUVD-2026-95148

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

The @enmaso/node-convert library (versions through 1.0.0) contains an OS command injection vulnerability in the convert.js component. The root cause is the use of unsanitized filepath and convertTo arguments when executing ImageMagick commands via child_process.exec() . Attackers can inject shell...

CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...