7632 matches found
EUVD-2026-47633
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in...
PT-2026-63400
Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description A path traversal issue exists in the file-based persistence storage provider. This occurs when the storage key is derived from user-controlled input, which can lead to...
PT-2026-63399
Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description Applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, which allows unauthenticated remote code execution...
PT-2026-63404
Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description A deserialization issue in the persistence utilities allows unsafe type instantiation from an attacker-influenced persisted state, which can lead to remote code execution...
CVE-2026-13190: Deserialization of Untrusted Data
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution...
CVE-2026-13186: Improper Limitation of a Pathname to a Restricted Directory
In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution...
openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21372-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21372-1 advisory. This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF...
Malicious code in streak-daycount (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f787426dd4d04d5cd527bdb19d309c64de82e252af4af0714dc33b07a26b73b0 [email protected] ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODEENV is not 'production', the code...
GHSA-RGV6-XP99-6MGJ Gitea Remember-Me Token Theft Not Invalidating Attacker Session
The vulnerability is in the Remember-Me giteaincredible token validation logic, specifically when handling a compromised token hash mismatch. The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/authtoken.goL33-L64...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
MAL-2026-10940 Malicious code in chai-leaf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...
Malicious code in chai-leaf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...
MAL-2026-11042 Malicious code in faust-cont (npm)
The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...
Malicious code in faust-cont (npm)
The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...
PT-2026-63306
Name of the Vulnerable Software and Affected Versions Gitea version 1.25.4 Description A flaw exists where webhooks created by a collaborator with admin permissions on a private repository continue to trigger after the collaborator's access has been revoked. The DeleteCollaboration function in...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection through the audit event search ORDER BY handling in JPAAuditEventDAO and Neo4jAuditEventDAO. An administrator with the right entitlements can execute arbitrary SQL by supplying crafted sort parameters in an audit-events...
MAL-2026-10919 Malicious code in ml-core-airflow-auth (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a543a55b463967fa7f6b3c1462ecb38735072a4f4f47bf5f9b732e089a64b8a The package advertises itself as an 'auth token handler' but its public API src/mlcoreairflowauth/init.py exposes only a trivial in-memory TokenStore...
Malicious code in ml-core-airflow-auth (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a543a55b463967fa7f6b3c1462ecb38735072a4f4f47bf5f9b732e089a64b8a The package advertises itself as an 'auth token handler' but its public API src/mlcoreairflowauth/init.py exposes only a trivial in-memory TokenStore...
SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - gitcredentialmanager versions 2.8.0...
Malicious code in @gocortexio/npmgremlinbox-tpl-1-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4200adb48a5ba3c3a6b1010a539b34fed01844465dab58cd7f964cd6c776d871 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...