MAL-2026-6353 Malicious code in markdownlint-cli2-fix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca7d5154ecbbcc636198bd2314e1916e5f0673d37ab7b14caca2ea96ad5ac5e1 Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionality — the README states...

CVE-2026-50193 jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as JsonNode...

[R3] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities

R3 Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities Aaron Roy Tue, 06/23/2026 - 16:43 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components .NET Windows Server Hosting, NodeJS, Erlang OTP, SQ...

CVE-2026-41579 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin-fips, podman, node-feature-discovery-fips, podman-fips, node-feature-discovery, sriov-network-device-plugin, gpu-operator, cadvisor, cadvisor-fips, gpu-operator-fips, prometheus-podman-exporter, buildah-fips, buildah, rancher-agent, ranche...

GHSA-XJVP-4FHW-GC47 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin-fips, podman, node-feature-discovery-fips, podman-fips, node-feature-discovery, sriov-network-device-plugin, gpu-operator, cadvisor, cadvisor-fips, gpu-operator-fips, prometheus-podman-exporter, buildah-fips, buildah, rancher-agent, ranche...

Malicious code in log-taker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b4bde2f8e6fa87d896e86967b814a70ae3e46f1b1d58ed4552d1d909fbfcfe index.js imports childprocess and invokes execSync with bash and zsh shell strings around lines 315 and 331. The pattern of spawning interactive shel...

GHSA-XJVP-4FHW-GC47 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin, k8s-device-plugin, cadvisor, buildah, node-feature-discovery, nvidia-container-toolkit, podman...

CVE-2026-41579 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin, k8s-device-plugin, cadvisor, buildah, node-feature-discovery, nvidia-container-toolkit, podman...

MAL-2026-6341 Malicious code in react-check-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d89ef9716015743217a9492f4b4469459da701a1b6198851f1527033f1e5c9ae On require, index.js invokes initMsgCache at module top level. The function derives an AES-256-CBC key, IV, and ciphertext from a hardcoded 161-byte...

libxslt: use-after-free with key data stored cross-RVT

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash...

Malicious code in rainbokit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 692bd458c1417d7b87761cfa62e666685cb8d2ebf605b54de3ef8ad5dd993555 The package publishes as rainbokit but ships a verbatim copy of the legitimate big.js library matching author, repository URL, README, LICENCE, and...

MAL-2026-6337 Malicious code in hunsterx-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32f2430d6e0da9484283d0012a16df0c593ccb5fa2a56ea727bd19ba435f964f preinstall.js executes a chain of evalBuffer.from'','base64'.toString payloads at npm install time. The decoded payloads collect host identity...

Cross-site Scripting (XSS)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the webhookId parameter in the Chat Trigger node. An attacker can execute arbitrary JavaScript in the context of another user's session by injecting malicious code, which is the...

Directory Traversal

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Directory Traversal via the Clone or Push operations in the Git node when a local filesystem path is supplied as the source or target repository, bypassing the intended file sandbox. An attacker can...

CVE-2026-49406

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field...

Prototype Pollution

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Prototype Pollution via the Microsoft SQL node’s createTableStruct and related table-grouping logic in MicrosoftSql.node.ts and GenericFunctions.ts. An authenticated user who can create or modify...

CVE-2026-44726

Summary: CVE-2026-44726 affects Deno up to 2.7.7, where a flaw in Deno’s Node.js TLS compatibility layer can cause plaintext data to be sent after a connection retry when autoSelectFamily is enabled. The root cause is that the socket reinitialization path reuses a stale TLS upgrade hook tied to t...

CVE-2026-49411 Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address fo...

CVE-2026-49411 Deno Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility TCP path checked the permission against the original hostname string before resolution and then did not re-check after resolution. A caller could therefore pass a numeric alias of an IP address fo...

CVE-2026-49411

Summary (technical, grounded): CVE-2026-49411 affects Deno’s Node.js compatibility TCP path. Prior to v2.8.0, permission checks for deny-net were performed on the original hostname string before DNS resolution and not re-checked after resolution. This allowed a numeric IP alias (for example 21307...