267277 matches found
EUVD-2026-60943
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...
CVE-2026-71539
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...
CVE-2026-71539 n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...
CVE-2026-71539
In n8n, an authenticated user can exploit a race condition in the Git node clone operation to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart, enabling remote code execution...
CVE-2026-71539 n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...
CVE-2026-71539
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...
GO-2026-6129 Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption in github.com/fission/fission
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAPSYSTIME and cross-tenant node wall-clock corruption in github.com/fission/fission...
GO-2026-6106 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve...
GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings
Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...
PT-2026-77236
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...
PT-2026-77237
Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The checkArticleUrl function in defaultmodules/newsfeed/node helper.js accepts the CHECK ARTICLE URL notification via the unauthenticated Socket.IO namespace /newsfeed. The system performs a...
PT-2026-77308
Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.3 Description An authorization bypass exists in the allowDashboard gate within server/integrations/node-red/index.js where authJwt.verify is called for the /nodered endpoint without inspecting the decoded identity...
nodejs:24 security update
nodejs 1:24.18.0-6 - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257 fixed in 5.0.8. 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - deps: update sqlite to 3.53.4...
Microsoft Windows Admin Center Remote Code Execution
Microsoft Windows Admin Center builds prior to 2.7.4 contain a command injection vulnerability in the PowerShell tool REST API. An authenticated low-privileged gateway user can supply arbitrary commands through the properties.script field of an invokeCommand request, resulting in command executio...
MiracleLinux 9 : nodejs:24 (AXSA:2026-1559:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1559:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...
MiracleLinux 9 : [security - high] nodejs:22 (AXSA:2026-1561:01)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1561:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...
CVE-2026-67443: Missing Authorization
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...
PT-2026-80399
Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...
PT-2026-80374
Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP SYS TIME and cross-tenant node wall-clock corruption in github.com/fission/fission...