CVE-2026-33660 n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and achieve remote code execution. The AlaSQ...

CVE-2026-33660

The CVE-2026-33660 issue affects n8n, an open source workflow automation platform. Before versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user who can create/modify workflows could use the Merge node in Combine by SQL mode to read local host files and achieve remote code execution. The Al...

CVE-2026-33660 n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and achieve remote code execution. The AlaSQ...

CVE-2026-33660

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and achieve remote code execution. The AlaSQ...

SUSE CVE-2026-23314

In the Linux kernel, the following vulnerability has been resolved: regulator: bq257xx: Fix device node reference leak in bq257xxregdtparsegpio In bq257xxregdtparsegpio, if fails to get subchild, it returns without calling ofnodeputchild, causing the device node reference leak...

Malicious code in json-lucide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12d05056fbe7eca08a66d7297aac2b03763073361f0cb33c238a4463f64a0867 The package json-lucide was found to contain malicious code. Source: ghsa-malware 30298bc83e4bdadd246cfdec7006f865348448a5147e0a8258cd4d4feaf7b27f An...

MAL-2026-2200 Malicious code in json-lucide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12d05056fbe7eca08a66d7297aac2b03763073361f0cb33c238a4463f64a0867 The package json-lucide was found to contain malicious code. Source: ghsa-malware 30298bc83e4bdadd246cfdec7006f865348448a5147e0a8258cd4d4feaf7b27f An...

CVE-2026-26832

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to childprocess.exec...

CVE-2026-23326

A flaw was found in the Linux kernel. An issue in the eXpress Data Path XDP socket xsk component, specifically during fragment node deletion, can lead to a buffer leak. This occurs because a list node is not properly reinitialized after removal, causing the system to incorrectly manage memory. Th...

pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via...

Malicious code in omaronsec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ff0bfae46cd199f9de68fa7a40d0f579cd8918783db054a2eb83c8cf047424f The package omaronsec was found to contain malicious code. Source: ghsa-malware 67e67c70590c02b44ced517d12ded441ebcd7e80617a6818d06ad836620910f6 Any...

Malicious code in omicnavigatorwebapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 327bf8baa88f730faf7a3b96a6acc527533ef6b39c5274246cfc00c72d6c30d2 The package omicnavigatorwebapp was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2199 Malicious code in omicnavigatorwebapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 327bf8baa88f730faf7a3b96a6acc527533ef6b39c5274246cfc00c72d6c30d2 The package omicnavigatorwebapp was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2198 Malicious code in omaronsec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ff0bfae46cd199f9de68fa7a40d0f579cd8918783db054a2eb83c8cf047424f The package omaronsec was found to contain malicious code. Source: ghsa-malware 67e67c70590c02b44ced517d12ded441ebcd7e80617a6818d06ad836620910f6 Any...

MAL-2026-2196 Malicious code in tailwind-compile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbf65c7619b6b53280e5b8466ad34ab144b9e6f1da1ab9a80fc621001cc380e The package tailwind-compile was found to contain malicious code. Source: ghsa-malware c6dd40384bf67bcd86f55c070ba74b522d8a9531dec334d4604f0b3737cd96...

MAL-2026-2195 Malicious code in super-alias (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10ee12ec5ce74c0899ed60e17d1baf7095efc7ab305e51d4fcf20db72306621f The package super-alias was found to contain malicious code. Source: ghsa-malware 2c8c29e0ebca0170c77383154e5c6f2fe5280412fea18d255b496b94ae0aac5f An...

Malicious code in ffsixx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9f3bd6ac910228b4db9832fda2251598107f0be87613ccdbcb655cfd1978a99 The package ffsixx was found to contain malicious code. Source: ghsa-malware 89053ab3da5a9f739d2b29eb1a0c041ab7f91a7c9ab594cddb056f65ba97ce5b Any...

Malicious code in super-alias (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10ee12ec5ce74c0899ed60e17d1baf7095efc7ab305e51d4fcf20db72306621f The package super-alias was found to contain malicious code. Source: ghsa-malware 2c8c29e0ebca0170c77383154e5c6f2fe5280412fea18d255b496b94ae0aac5f An...

Malicious code in @sixcore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1286e85f8b045ceb430500873b6a172bc5bef2193da8d53ec25183e7a4984cd8 The package @sixcore/baileys was found to contain malicious code. Source: ghsa-malware 4d631c0d901cd4ee9e33f1b24f2a7e067cb4369c7813ce8d46e7e7f0e2217a...

Malicious code in changelog-utils-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bec9a644e6b7c6be0e1e95ad8690cf8c19568061865f8e185552431e09fbb38c The package changelog-utils-wrapper was found to contain malicious code. Source: ghsa-malware...