266080 matches found
CLEANSTART-2026-ZJ53876 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CLEANSTART-2026-NK73842 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CLEANSTART-2026-IQ33916 compression is a Node
Security vulnerability affects the argo-workflows package. compression is a Node...
CLEANSTART-2026-MW03453 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CLEANSTART-2026-LK90655 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node
Security vulnerability affects the grafana-alloy package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...
PT-2026-108360
Security vulnerability affects the langfuse package. undici's experimental WebSocketStream client crashes the whole Node...
PT-2026-108594
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
CVE-2026-103042: Allocation of Resources Without Limits or Throttling
LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pdtransmode nccl, allowing unauthenticated attackers to exhaust KV-transfer worker memory. Attackers can call the exposedsetvalue method to store unbounded key-value pairs without siz...
PT-2026-102937
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description A memory exhaustion issue exists in the NCCL control channel when the software is started with the --pd trans mode nccl configuration. Unauthenticated attackers can exploit this by calling the expos...
PT-2026-108425
Security vulnerability affects the langfuse package. undici's WebSocket client crashes the whole Node...
@1mcp/agent (>=0.39.0-beta.4, <=0.39.3), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +260 more potentially affected by unknown CVE via @hono/node-server (>=2.0.0, <=2.1.1)
@hono/node-server NPM version =2.0.0, =0.39.0-beta.4, =0.1.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.4.0, =0.8.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.8, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.47 and more Source cves: unknown CVE Source advisory:...
PT-2026-108485
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
PT-2026-108476
Security vulnerability affects the argo-workflows package. Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript...
Malicious code in native-env (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9c612513357181c7e4d504f94a2a8c03de64724e2593217216de8fef4e7166 [email protected] presents itself as a zero-dependency dotenv toolkit but executes attacker-chosen code on Windows the moment the module is required o...
Server-generated Error Message Containing Sensitive Information
Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...
CVE-2026-101905
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...
CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...
CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...
CVE-2026-101905
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...
CVE-2026-101905
The Axios HTTP client is vulnerable to a request socket hijack in versions 1.15.2 through 1.20.0 . The root cause lies in the Node HTTP adapter (lib/adapters/http.js), which fails to provide its own createConnection value. When combined with a separate same-process prototype-pollution flaw that p...