CVE-2026-0748

A flaw was found in the Drupal 7 Internationalization i18n module, specifically within its i18nnode submodule. A user possessing both "Translate content" and "Administer content translations" permissions can exploit this vulnerability. By utilizing the translation user interface UI and its...

CVE-2026-33713

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could exploit a SQL injection vulnerability in the Data Table Get node. On default SQLite DB, single statements can be manipulate...

CVE-2026-33696

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the XML and the GSuiteAdmin nodes. By supplying a crafted parameters as part...

CVE-2026-33660

n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify workflows could use the Merge node's "Combine by SQL" mode to read local files on the n8n host and achieve remote code execution. The AlaSQ...

CVE-2026-0748

In the Drupal 7 Internationalization i18n module, the i18nnode submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls an...

CVE-2026-1556

Information disclosure in the file URI processing of File Field Paths in Drupal File Field Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other users’ private files via filename‑collision uploads. This can cause hooknodeinsert consumers for example, email attachment...

Improper Certificate Validation

Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Improper Certificate Validation in the verifyCertificateChain function. An attacker can gain unauthorized certificate authority capabilities by presenting a certificate chain where ...

Improper Certificate Validation

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Improper Certificate Validation in the verifyCertificateChain function. An attacker can gain...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33896 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33896 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789772...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1166 more potentially affected by CVE-2026-33896 via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33896 Source advisory: OSV:GHSA-2328-F5F3-GJ25...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1166 more potentially affected by CVE-2026-33896 via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33896 Source advisory: SNYK:JS-NODEFORGE-15789771...

Improper Verification of Cryptographic Signature

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the ed25519.verify function. An attacker can bypas...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33895 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33895 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789768...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1166 more potentially affected by CVE-2026-33895 via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33895 Source advisory: OSV:GHSA-Q67F-28XG-22RW...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1166 more potentially affected by CVE-2026-33895 via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33895 Source advisory: SNYK:JS-NODEFORGE-15789767...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1166 more potentially affected by CVE-2026-33894 +1 more via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33894, CVE-2026-85393 Source advisory: OSV:GHSA-PPP5-5V6C-4JWP...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1166 more potentially affected by CVE-2026-33894 via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33894 Source advisory: SNYK:JS-NODEFORGE-15789773...

Improper Verification of Cryptographic Signature

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in ASN.1 structures during RSA signature verification...

org.webjars.npm:github-com-cisco-node-jose (2.2.0), org.webjars.npm:google-auth-library (>=1.6.1, <=6.1.6) +7 more potentially affected by CVE-2026-33894 via org.webjars.npm:node-forge (>=0.7.1, <=1.3.3)

org.webjars.npm:node-forge MAVEN version =0.7.1, =1.6.1, =1.0.2, =2.3.2, =1.10.2, =2.1.1 Source cves: CVE-2026-33894 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15789774...

Infinite loop

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Infinite loop via the modInverse function. An attacker can cause the application to hang indefinitely...