255567 matches found
CVE-2026-58478
SIP 5.2.16 has a server-side request forgery (SSRF) vulnerability when the optional Node-RED plugin is installed. An unauthenticated attacker can supply a malicious callback URL and cause the device to issue arbitrary HTTP requests due to lack of destination validation, aided by the default passp...
CVE-2026-58478 Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL
Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...
CVE-2026-59875 vulnerabilities
Vulnerabilities for packages: lerna, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, opensearch-dashboards, actions-runner, code-server, graalvm, pulumi, sqlpad, kibana, gitlab-rails-ce-fips, prism, saf, wazuh-dashboard, gitlab-rails-ce, opensearch-dashboards-fips...
CVE-2026-59874 vulnerabilities
Vulnerabilities for packages: lerna, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, opensearch-dashboards, actions-runner, code-server, graalvm, pulumi, sqlpad, kibana, gitlab-rails-ce-fips, homepage, prism, saf, wazuh-dashboard, gitlab-rails-ce, opensearch-dashboards-fips...
CVE-2026-59873 vulnerabilities
Vulnerabilities for packages: lerna, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, opensearch-dashboards, actions-runner, code-server, graalvm, pulumi, sqlpad, kibana, gitlab-rails-ce-fips, homepage, prism, saf, wazuh-dashboard, gitlab-rails-ce, opensearch-dashboards-fips...
CVE-2026-59875 vulnerabilities
Vulnerabilities for packages: code-server, lerna, npm, pulumi, prism, kubeflow-centraldashboard, sqlpad, saf...
CVE-2026-59871 vulnerabilities
Vulnerabilities for packages: code-server, lerna, npm, pulumi, prism, kubeflow-centraldashboard, sqlpad, saf...
Malicious code in async-mutex-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5 Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry index.js exports...
MAL-2026-10589 Malicious code in nodeaxois (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...
MAL-2026-10583 Malicious code in chalkdev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...
MAL-2026-10590 Malicious code in openaiwrapper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...
Malicious code in crypto-validate-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...
MAL-2026-10579 Malicious code in bimi-maker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...
Security Bulletin: Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-23950 DESCRIPTION: node-tar,a...
nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()
A flaw was found in the Node.js WebCrypto implementation. A remote attacker could exploit this vulnerability by providing an input to the subtle.encrypt function that is a multiple of 2 gigabytes GiB. This could lead to a denial of service DoS by crashing the Node.js process...
USN-8536-1 mariadb vulnerabilities
It was discovered that MariaDB did not properly validate parameters supplied by a joiner node during a State Snapshot Transfer using the mariabackup method. An attacker could possibly use this issue to execute arbitrary shell commands on the donor node. CVE-2026-44168 It was discovered that Maria...
ROOT-APP-NPM-CVE-2022-0122 CVE-2022-0122 in @rootio/node-forge - Patched by Root
Root has patched CVE-2022-0122 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2020-7720 CVE-2020-7720 in @rootio/node-forge - Patched by Root
Root has patched CVE-2020-7720 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...