CVE-2019-10756

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

CVE-2025-24522

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system...

CVE-2025-24522

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system...

CVE-2025-24522

CVE-2025-24522 affects KUNBUS Revolution Pi OS Bookworm 01/2025 where Node-RED authentication is not configured by default. An unauthenticated remote attacker can gain full access to the Node-RED server and execute arbitrary OS commands (impacting PLC control). Connected sources describe the root...

CVE-2025-24522 KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system...

CVE-2025-24522 KUNBUS Revolution Pi Authentication Bypass by Primary Weakness

KUNBUS Revolution Pi OS Bookworm 01/2025 is vulnerable because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server where they can run arbitrary commands on the underlying operating system...

PT-2025-18781 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: IntelR TiberTM Edge Platform Edge Orchestrator versions prior to 24.11.1 Description: A protection mechanism failure exists in some Edge Orchestrator software. An authenticated user may be able to enable a denial of service via adjacent acces...

PT-2025-18782 · Undefined · Undefined

@CISAgov 2/8 🏭 Revolution Pi vulnerability details: The industrial IoT platform has THREE critical flaws CVE-2025-24522, CVE-2025-24523, CVE-2025-24524 with CVSS scores up to 10.0! These affect Node-RED and PiCtory components widely used in manufacturing, energy, and water sectors...

PT-2025-18691 · Kunbus +1 · Kunbus Revolution Pi Os +1

Name of the Vulnerable Software and Affected Versions: KUNBUS Revolution Pi OS Bookworm 01/2025 Description: The issue arises because authentication is not configured by default for the Node-RED server. This can give an unauthenticated remote attacker full access to the Node-RED server, where the...

KUNBUS Revolution Pi OS Bookworm 安全漏洞

KUNBUS Revolution Pi OS Bookworm is an industrial-grade real-time operating system based on Debian Bookworm from KUNBUS. A security vulnerability exists in KUNBUS Revolution Pi OS Bookworm 01/2025 that stems from the Node-RED server not being configured for authentication by default, which could...

MAL-2024-9732 Malicious code in node-red-contrib-request (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in node-red-contrib-request (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in node-red-contrib-lowwercase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 577092139d0eab16ce212c5f1857a5bd55b8632d4d93358b21d74e379dbf7f60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9242 Malicious code in node-red-contrib-lowwercase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 577092139d0eab16ce212c5f1857a5bd55b8632d4d93358b21d74e379dbf7f60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

D-Link G416 nodered gz file command injection vulnerability

D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 , which supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection vulnerability that stems from a nodered gz file handling command...

D-Link G416 nodered tar file command injection vulnerability

D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 , which supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection vulnerability that stems from a nodered tar file handling command...

D-Link G416 安全漏洞

D-Link G416 is the AX1500 4G+ Smart Router launched by AUO in June 2025 , which supports Wi-Fi 6, AI Smart Optimization and 4G LTE Cat 6 network with up to 300Mbps internet speed. The D-Link G416 suffers from a command injection vulnerability that stems from a nodered gz file handling command...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +244 more potentially affected by CVE-2024-27307 via jsonata (>=1.5.0, <=1.8.6)

jsonata NPM version =1.5.0, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.8.0, =0.0.1, =1.0.0, =1.0.1, =2.0.0, =2.0.4 - @elastic.io/batching-library 2.0.1-dev.4 and more Source cves: CVE-2024-27307 Source advisory: OSV:GHSA-FQG8-VFV7-8FJ8...

Malicious code in node-red-contrib-object-to-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc617e826788805ca870b385151ace964f43893d9560c8b2d9615276520929a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1030 Malicious code in node-red-contrib-object-to-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc617e826788805ca870b385151ace964f43893d9560c8b2d9615276520929a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...