Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub (Db2IC)

Summary Dependency updates and code fixes were done to fix multiple vulnerabilties found in Db2 intelligence center. Vulnerability Details CVEID:CVE-2026-109838 DESCRIPTION: IBM Db2 Genius Hub could allow a local attacker to obtain sensitive information due to improper verification of cryptograph...

MAL-2026-17683 Malicious code in node-fetch-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-35219

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

EUVD-2026-60381

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

CVE-2026-35219: Server-Side Request Forgery (SSRF)

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

PT-2026-75931

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

CLSA-2026-1775003170 TuxCare security update for node-fetch (1 CVE)

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

CLSA-2026-1775003169 TuxCare security update for node-fetch (1 CVE)

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...

CLSA-2026-1775003167 TuxCare security update for node-fetch (1 CVE)

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...

PT-2026-74250

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...

PT-2026-74252

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...

PT-2026-74253

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...

Malicious Package

Overview @dexwilt/node-fetch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@dexwilt/mf-node (2.7.48) potentially affected by unknown CVE via @dexwilt/node-fetch (2.7.3)

@dexwilt/node-fetch NPM version 2.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on @dexwilt/node-fetch and may be impacted: - @dexwilt/mf-node 2.7.48 Source cves: unknown CVE Source advisory: GHSA-XQJ6-R3QP-9RX9...

@dexwilt/mf-node (>=2.7.47, <=2.7.48) potentially affected by unknown CVE via @dexwilt/node-fetch (>=2.7.2, <=2.7.3)

@dexwilt/node-fetch NPM version =2.7.2, =2.7.47, =2.7.48 Source cves: unknown CVE Source advisory: SNYK:JS-DEXWILTNODEFETCH-18488459...