Prototype Pollution

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Prototype Pollution via the Edit Fields Set process when output fields are assigned using dot-notation path setters without restricting field names. An attacker can corrupt a shared global in the ma...

GHSA-WRF9-R3H7-7X5V Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Summary The POST /api/v1/repos/owner/repo/merge-upstream endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commits made after the parent...

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Summary The POST /api/v1/repos/owner/repo/merge-upstream endpoint continues to synchronize commits from a parent repository after the parent repository has been changed from public to private. A fork created while the parent repository was public can still receive commits made after the parent...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through changing a pull request's target branch without re-evaluating the official approval status on existing reviews. An attacker can bypass branch protection requirements and merge code into protected branches...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through changing a pull request's target branch without re-evaluating the official approval status on existing reviews. An attacker can bypass branch protection requirements and merge code into protected branches...

EUVD-2026-42315

Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set...

SUSE CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

PT-2026-63305

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description Gitea fails to re-evaluate the official flag on existing pull request reviews when the target branch of a pull request is changed. An attacker with write access to a repository can obtain an official:...

GHSA-GCFJ-64VW-6MP9 Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Summary Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch. Recent axios releases harden merged request config by creating a null-prototype object...

EUVD-2026-42302

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml...

js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

GHSA-G796-FGMG-93MV js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.1.0...

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.0...

EUVD-2026-42301

js-yaml: YAML merge-key chains can force quadratic CPU consumption...

GHSA-52CP-R559-CP3M js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...

CVE-2026-64053

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...