60 matches found
Server-side Request Forgery (SSRF)
Overview @sveltejs/adapter-node is an Adapter for SvelteKit apps that generates a standalone Node server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the improper decoding of protocol headers in resolved path. An attacker can cause the server process...
Arbitrary File Upload
Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Arbitrary File Upload via the Git Node. An authenticated user can achieve execution of untrusted code by uploading malicious files that are subsequently executed by the service. This can lead to ful...
Exposed Dangerous Method or Function
Overview Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in the Code node when running in legacy JavaScript execution mode. An attacker can access or modify files on the host system with the same privileges as the application process by invoking internal...
GHSA-WPQC-H9WP-CHMQ n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
Impact The n8n Git node allows workflows to set arbitrary Git configuration values through the Add Config operation. When an attacker-controlled workflow sets core.hooksPath to a directory within the cloned repository containing a Git hook such as pre-commit, Git executes that hook during...
@agent-relay/daemon (>=2.0.5 <=2.3.14), @agent-relay/dashboard (>=2.0.18 <=2.0.19) +365 more potentially affected by unknown CVE via posthog-node (>=4.0.0 <=4.18.0)
posthog-node NPM version =4.0.0, =2.0.5, =2.0.18, =2.0.5, =2.0.5, =0.59.0, =1.0.0, =0.3.0, =1.0.0, =0.17.1, =1.1.1, =0.1.6, =1.0.0, =1.15.0, =0.7.107, =0.7.150 - @base44-preview/cli =0.0.25-pr.156.f6042c0 and more Source cves: unknown CVE Source advisory: SNYK:JS-POSTHOGNODE-14103346...
EUVD-2018-0228
Malware in sbrugna...
EUVD-2015-3012
Malware in sbrugna...
EUVD-2020-0029
Malware in sbrugna...
EUVD-2011-3930
Malware in sbrugna...
EUVD-2022-0215
Malicious code in bioql PyPI...
EUVD-2022-38147
Malicious code in bioql PyPI...
EUVD-2022-5589
Malicious code in bioql PyPI...
CVE-2025-57353
The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing...
@htmlgoddess/cli (>=0.3.5 <=0.4.4), @htmlgoddess/webpack-plugin (>=0.1.0 <=0.4.4) +24 more potentially affected by unknown CVE via babel-node (=0.0.1-security)
babel-node NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on babel-node and may be impacted: - @htmlgoddess/cli =0.3.5, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.2.0, =0.0.1, =0.0.7, =0.2.9, =0.5.2 and more Source cves: unknown CVE...
CVE-2025-54568
Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node...
Security Bulletin: IBM Maximo Application Suite - Manage Component uses node 16.16.0 which is vulnerable to CVE-2023-32002, CVE-2022-35255
Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses node 16.16.0 which is vulnerable to CVE-2023-32002, CVE-2022-35255. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2023-32002 DESCRIPTION: The use of...
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
CVE-2025-32395
CVE-2025-32395 affects Vite (frontend tooling for JavaScript). The vulnerability arises when a dev server is exposed to the network on Node/Bun (not Deno) and a request-target containing a # is processed, bypassing server.fs.deny due to req.url handling. Affected versions prior to 6.2.6, 6.1.5, 6...
CVE-2022-31006
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its intended purpose...