Gradle Enterprise Build Cache Node Login Panel - Detect

Gradle Enterprise Build Cache Node login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gradle Enterprise Build Cache Node login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Node Shrinkwrap Exposure Detection

A file created by npm shrinkwrap. It is identical to package-lock.json. !/usr/bin/env python3 -- coding: utf-8 -- """A file created by npm shrinkwrap.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node Shrinkwrap...

PNPM Lock Yaml File Disclosure Detection

The pnpm-lock.yaml file is similar to the package-lock.json file used by npm or the yarn.lock file used by Yarn. It serves as a lock file that ensures consistent and reproducible installations of dependencies across different environments. !/usr/bin/env python3 -- coding: utf-8 -- """The...

Node ecstatic Directory Listing Detection

Directiory listing enabled in Node ecstatic. !/usr/bin/env python3 -- coding: utf-8 -- """Directiory listing enabled in Node ecstatic.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node ecstatic Directory Listing...

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution Detection

n8n versions = 0.123.0 and = 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'n8n = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. A...

Node Express Status - Detect

Node Express Status is detected. !/usr/bin/env python3 -- coding: utf-8 -- """Node Express Status is detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node Express Status - Detect', 'description': 'Node Expre...

Node-RED Dashboard - Detect

Node-RED dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Node-RED Dashboard - Detect', 'description': 'Node-RED...

Node-RED - Unauthenticated Access Detection

Node-RED flow editor is accessible without authentication. Node-RED is a flow-based programming tool that can execute arbitrary system commands, read/write files, and make network requests. Unauthenticated access leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RE...

PCDN Cache Node Dataset Detection

PCDN Cache Node dataset is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PCDN Cache Node dataset is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PCDN Cache Node Dataset Detection', 'description':...

BIT-THRIFT-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-ELASTICSEARCH-2026-63144 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch que...

BIT-ELASTICSEARCH-2026-63140 Reachable Assertion in Elasticsearch Leading to Denial of Service

Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...

BIT-ELASTICSEARCH-2026-63136 Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and...

Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

MAL-2026-11106 Malicious code in date-sanitize-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b6764b7711cfa03cf6b3a2f70e24b3256a61ac9319d45200ada236fe7c3ed2 The package is advertised as a date parsing/sanitization helper but its postinstall.js runs automatically on npm install and performs installer-side...

MAL-2026-11108 Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa The package's postinstall.js lifecycle script executes a shell pipeline via childprocess.exec on npm install. The pipeline reads /.ssh/idrsa,...

MAL-2026-11097 Malicious code in @vaultflow/update-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 031c8cb2cc9eb21371fdd4a9a9d6949857fd978868e3dfd8f5d126e95a6a5780 index.js is a verbatim copy of the feross/buffer module with a single injected top-level statement var ins = import'@vaultflow/create-flow' that...

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malform...

PT-2026-65485

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto , were not handled as ordina...

RHEL 8 : nodejs:22 (RHSA-2026:47059)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47059 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...