CVE-2017-5941-NodeJS-RCE

CVE-2017-5941-NodeJS-RCE https://paper.seebug.org/213/...

CVE-2026-18540 affecting package nodejs for versions less than 24.22.0-1

CVE-2026-18540 affecting package nodejs for versions less than 24.22.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-87587 affecting package nodejs for versions less than 24.22.0-1

CVE-2026-87587 affecting package nodejs for versions less than 24.22.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-16729 affecting package nodejs for versions less than 24.22.0-1

CVE-2026-16729 affecting package nodejs for versions less than 24.22.0-1. An upgraded version of the package is available that resolves this issue...

Oracle Linux 8 : nodejs:22 (ELSA-2026-75870)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75870 advisory. - Patches pacote CVE and updates undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259888 RHEL-255268 nodejs-nodemon - Rebase...

AlmaLinux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1791841538)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791841538 advisory. - Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacke...

Oracle Linux 9 : nodejs:22 (ELSA-2026-76750)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76750 advisory. - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259889 RHEL-255272 - Update to version 22.23.2...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

MiracleLinux 9 : nodejs:22 (AXSA:2026-2084:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2084:01 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequest...

MiracleLinux 8 : [security - high] nodejs:22 (AXSA:2026-2091:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2091:01 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequest...

RHEL 9 : nodejs:22 (RHSA-2026:84589)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84589 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2014-7205

Bassmaster NodeJS Plugin RCE PoC bassmaster-rce.py: A Python script to exploit CVE-2014-7205. nodeshell.py: A Python module to generate a reverse shell for NodeJS !!Only use against servers on which you have permission to test Summary CVE-2014-7205 is a Remote Code Execution vulnerability in...

SUSE CVE-2026-96294

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9380: Backport to odf-4.17.z Backport CA related fixes for NooBaa DFBUGS-7336: Backport to odf-4.17.z 5.2...

AlmaLinux 9 : nodejs:24 (ALSA-2026:73838)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73838 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

AlmaLinux 9 : nodejs:22 (ALSA-2026:76750)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76750 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

CVE-2026-110644

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644

The nodejs-whisper library, version 0.3.1 and earlier , is vulnerable to OS Command Injection within the convertToWavType() function. The root cause is the insufficient sanitization of audio file paths, allowing attackers to inject $() command substitution or closing quotes. These inputs are inte...

EUVD-2026-101272

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...