MAL-2026-394 Malicious code in n8n-nodes-zl-vietts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2958734e09db17aba6589bb89622305f26fc83a16d475018b5ae88b694b9e4c The package n8n-nodes-zl-vietts was found to contain malicious code. Source: ghsa-malware...

Malicious code in @diendh/n8n-nodes-tiktok-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16a12e0244dc2ac8964ace7fecf5dab971eb0b394e2979bce9a3e12ce33b01ce The package @diendh/n8n-nodes-tiktok-v2 was found to contain malicious code. Source: ghsa-malware...

MAL-2026-378 Malicious code in @diendh/n8n-nodes-tiktok-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16a12e0244dc2ac8964ace7fecf5dab971eb0b394e2979bce9a3e12ce33b01ce The package @diendh/n8n-nodes-tiktok-v2 was found to contain malicious code. Source: ghsa-malware...

MAL-2026-385 Malicious code in blocks-builder-manifest-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30f5efa34a1c44d974502110177cb7a60daf579349ed25937e66e342f7f7c24f The package blocks-builder-manifest-generator was found to contain malicious code. Source: ghsa-malware...

MAL-2026-395 Malicious code in natateste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 223884e033273ef49ab45ba4ac8c051419acbd5c7613c862e86fea2a817d5226 The package natateste was found to contain malicious code. Source: ghsa-malware b2bc57aed3208a3a97a2ed539e0782979641ab8312a75dcdb5056540c564d870 Any...

Malicious code in natateste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 223884e033273ef49ab45ba4ac8c051419acbd5c7613c862e86fea2a817d5226 The package natateste was found to contain malicious code. Source: ghsa-malware b2bc57aed3208a3a97a2ed539e0782979641ab8312a75dcdb5056540c564d870 Any...

MAL-2026-401 Malicious code in victim-package-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184f83df9021c2d9d54bd3201652ab449b3c54a606b87c484d0a16a657005cf8 The package victim-package-c was found to contain malicious code. Source: ghsa-malware c9415f83d650ad0546aeb398d909c1b7aa8c983d9ca0c37f72e68526eaf6bb...

Malicious code in victim-package-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e8188fd82f0ea4ee410d725bb96ab33af5767241fcefb555ef8dfaffd39bf The package victim-package-b was found to contain malicious code. Source: ghsa-malware 324aadc54f696916c968e82f4704d088384eab1ce76c08f2a3d3d0aa59fece...

MAL-2026-400 Malicious code in victim-package-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e8188fd82f0ea4ee410d725bb96ab33af5767241fcefb555ef8dfaffd39bf The package victim-package-b was found to contain malicious code. Source: ghsa-malware 324aadc54f696916c968e82f4704d088384eab1ce76c08f2a3d3d0aa59fece...

MAL-2026-377 Malicious code in potdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a65730c16a2c27ad2cc810d067426e10aa9a28fae114fe94bb6f26e54bc45bc The package potdf was found to contain malicious code. Source: ghsa-malware 9537cd4226a1c122965aec751dfcb6153489552f7e29f57dcd62274654ec136a Any...

Malicious code in potdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a65730c16a2c27ad2cc810d067426e10aa9a28fae114fe94bb6f26e54bc45bc The package potdf was found to contain malicious code. Source: ghsa-malware 9537cd4226a1c122965aec751dfcb6153489552f7e29f57dcd62274654ec136a Any...

External Secrets Security Vulnerabilities

External Secrets is an open-source Kubernetes-related application developed by External Secrets. There were security vulnerabilities in versions 0.20.2 to 1.2.0 of External Secrets. These vulnerabilities stemmed from the getSecretKey template function, which allowed access to secrets across...

AZL-74967 CVE-2025-55131 affecting package nodejs18 for versions less than 18.20.3-11

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

CVE-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

AZL-74979 CVE-2025-55131 affecting package nodejs for versions less than 20.14.0-13

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

CVE-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

CVE-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

CVE-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

GHSA-77V3-R3JW-J2V2 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the getSecretKey function. An attacker can gain unauthorized access to secrets across namespaces by exploiting the function's ability to bypass security mechanisms and retrieve secrets using elevated...