Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

MAL-2026-13898 Malicious code in @years19/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ea443e408aedb0f2eae3d36e29ae73e81d17330f435d5c1c71399c1dd42d51 On npm install postinstall runs callback.js and again on require of the package identical payload in index.js as the declared main, the package...

Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

MAL-2026-13848 Malicious code in @years18/n8n-nodes-utils-helper-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf84337e9bfc6e73590b5a3e89e88a245d4387b437ae765517889db0cded1fe The package declares itself as a workflow-automation helper but its postinstall script node callback.js fetches a tarball from...

Malicious code in @years18/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55fa2e2abba500f0c2863993fb8d51c3363f22a3fa8917fdf73e4b2545b81ea6 On npm install, the declared postinstall script node callback.js performs two hostile actions against the installer. First, it downloads a tarball fr...

Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed,...

Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4 The package presents itself as an n8n community node but ships a stub node file nodes/PwnNode.node.js, 213 bytes, description "x" whose only real...

MAL-2026-13859 Malicious code in @years18/n8n-nodes-utils-helper-o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7ec0fd707d50145d85051b5c960139ebe64dc5f12c89ee22ecfa8402d169c4 The package presents itself as an n8n community node but ships a stub node file nodes/PwnNode.node.js, 213 bytes, description "x" whose only real...

MAL-2026-13862 Malicious code in @years18/n8n-nodes-utils-helper-r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4bb7a1bd57477bf3cbbb1ccc9b76a2ed8b96a8117e0a4cad882b76404c86fb @years18/n8n-nodes-utils-helper-r ships a postinstall script that, on npm install, downloads a tarball from...

MAL-2026-13867 Malicious code in @years18/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab This package presents itself as an n8n workflow helper but ships a near-empty node stub nodes/PwnNode.node.js, 213 bytes while its postinstall hook a...

SUSE-SU-2026:23176-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issue: - CVE-2026-9375: oversized Brotli payload via the streaming API can lead to a denial of service bsc1268683...

Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-9318

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

CVE-2026-9318 tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

PT-2026-71341

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

CVE-2026-48809

CVE-2026-48809 – python-engineio : The issue affects the python-engineio server prior to version 4.13.2, where the size of incoming messages could be loaded into memory before validation, enabling potential DoS through excessive memory allocation. Two configurations are affected: POST requests wi...

CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...

CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...

CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...

netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion...