@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +41 more potentially affected by CVE-2026-54156 via node-opcua (>=2.10.0, <=2.165.2)

node-opcua NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-54156 Source advisory:...

NPM: node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS

NPM: node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS vulnerability discovered by ? in WordPress Npm node-opcua versions 2.166.0...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +41 more potentially affected by CVE-2026-54155 via node-opcua (>=2.10.0, <=2.165.0)

node-opcua NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-54155 Source advisory:...

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +41 more potentially affected by CVE-2026-54155 via node-opcua (>=2.10.0, <=2.165.0)

node-opcua NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.197, =1.3.6-alpha.36, =1.3.5, =1.4.15-alpha.279, =1.4.15-alpha.279, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =1.3.6-alpha.36 and more Source cves: CVE-2026-54155 Source advisory:...

GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

NPM: node-opcua missing nonce verification in UserNameIdentityToken authentication

NPM: node-opcua missing nonce verification in UserNameIdentityToken authentication vulnerability discovered by ? in WordPress Npm node-opcua versions = 2.165.0...

stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

GHSA-5P3M-VHH6-9236 stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Summary Stigmem allows an authenticated user to create a webhook subscription with a user-controlled deliveryaddress. That value is stored and later used directly by the subscription delivery worker as the destination of a server-side HTTP POST request. The codebase already contains an outbound...

Server-side Request Forgery (SSRF)

Overview stigmem-node is a Stigmem reference node — single-host production implementation Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the deliveryaddress parameter in webhook subscription creation and delivery processes. An attacker can cause the serve...

kbd: Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

@n8n/agents (0.17.0), @n8n/ai-node-sdk (0.22.0) +6 more potentially affected by CVE-2026-77085 via @n8n/ai-utilities (0.25.0)

@n8n/ai-utilities NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/ai-utilities and may be impacted: - @n8n/agents 0.17.0 - @n8n/ai-node-sdk 0.22.0 - @n8n/ai-workflow-builder 1.32.0 - @n8n/create-node 0.40.0 - @n8n/instance-ai...

CVE-2026-63042

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

Malware in node-multi-downloader

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview node-multi-downloader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

EUVD-2026-63403

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042 Apache InLong: Missing authorization on DataNode management endpoints

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-63042

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...