GO-2026-6106 Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve...

GO-2026-6158 Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...

PT-2026-77236

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

PT-2026-77237

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The checkArticleUrl function in defaultmodules/newsfeed/node helper.js accepts the CHECK ARTICLE URL notification via the unauthenticated Socket.IO namespace /newsfeed. The system performs a...

PT-2026-77308

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.3 Description An authorization bypass exists in the allowDashboard gate within server/integrations/node-red/index.js where authJwt.verify is called for the /nodered endpoint without inspecting the decoded identity...

Microsoft Windows Admin Center Remote Code Execution

Microsoft Windows Admin Center builds prior to 2.7.4 contain a command injection vulnerability in the PowerShell tool REST API. An authenticated low-privileged gateway user can supply arbitrary commands through the properties.script field of an invokeCommand request, resulting in command executio...

MiracleLinux 9 : nodejs:24 (AXSA:2026-1559:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1559:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

CVE-2026-67443: Missing Authorization

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

PT-2026-80399

Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings...

PT-2026-80374

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP SYS TIME and cross-tenant node wall-clock corruption in github.com/fission/fission...

PT-2026-80352

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve...

PT-2026-80302

Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRET NAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...

Linux Distros Unpatched Vulnerability : CVE-2026-74384

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node...

PT-2026-80397

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule...

CVE-2026-71539: Time-of-check Time-of-use (TOCTOU) Race Condition

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

PT-2026-77137

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description The Git node clone operation allows an authenticated workflow user to replace a validated directory with a symlink before the cloning process...

PT-2026-78153

Fix already patched since July! A critical vote-validation vulnerability affecting Atto node versions older than 1.33 has been fixed. The flaw could allow a connected peer to claim another representative’s voting weight before the received vote’s signature was validated. It is rated CVSS 9.3. If...

CVE-2026-32657: UNIX Symbolic Link (Symlink) Following

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version 4.5.4, Dell PowerFlex Intelligent Catalog Versions 46.377.00 and 46.382.00 and Dell PowerFlex...

nodejs:24 security update

nodejs 1:24.18.0-6 - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257 fixed in 5.0.8. 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - deps: update sqlite to 3.53.4...

Oracle Linux 10 : nodejs22 (ELSA-2026-55541)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55541 advisory. - Fix for CVE-2026-69152 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address - Fix CVE-2026-13149 npm/brace-expansion - Fix for CVE-2026-59873 and...