MAL-2026-4617 Malicious code in n8n-nodes-pentest-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a813bc4a209e75b50151451de1c2a3c4a7e916b181b314416eafc43492b4eb5 On npm install, the package's postinstall script runs a shell pipeline that reads the Kubernetes service-account token from...

PT-2026-42619

Summary mcp-server-kubernetes exposes three environment variables ALLOW ONLY READONLY TOOLS, ALLOW ONLY NON DESTRUCTIVE TOOLS, ALLOWED TOOLS documented as access controls for restricting which Kubernetes operations are available. These controls are enforced at the tool discovery layer tools/list...

PT-2026-42684

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.23.0 Description The storagesvc component registers archive CRUD handlers on its HTTP router without authentication or authorization. This allows any caller capable of reaching the storagesvc ClusterIP, such as othe...

ANT-2026-DJBBBBPE · temporalio/temporal · Broken Access Control

broken-access-control low CVE-2026-5199 Severity Claude critical · Security research firm - · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-DJBBBBPE: Cross-namespace manipulation including deletion of workflows on the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: Fixed a fget leak when the file system does not support nowait buffered reads. Heming reported a bug when using iouring for link-cp operations on ocfs2. 1 The following steps can reproduce this bug: mount -t ocfs2 /dev/v...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: A bug that led to out-of-bounds access was fixed in the mchpipcgetclusteraggrirq function. The clustercfg array is dynamically allocated to hold per-CPU configuration structures. Its size is determined by t...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-021655)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021655 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2getinitinode fails syzbot is reporting busy inodes after unmount, for...

PT-2026-78511

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Wazuh versions 5.0.0-beta1 through 5.0.0-beta2 Description An issue exists where the cluster.unmerge info function in framework/wazuh/core/cluster/cluster.py constructs paths using peer-controlled merge type...

Veritas InfoScale CmdServer 访问控制错误漏洞

Veritas InfoScale CmdServer is a command execution and remote management service component provided by Veritas Corporation in the US, designed for InfoScale cluster environments. Versions of Veritas InfoScale CmdServer prior to 7.4.2 contained an access control vulnerability, which was caused by...

Veritas Technologies Infoscale Operations Manager 跨站请求伪造漏洞

Veritas Technologies Infoscale Operations Manager is a software developed by Veritas Technologies in the United States, used for managing the entire InfoScale deployment. This software offers features such as multi-cluster management, custom interfaces, and centralized audit logging. Version 9.1....

org.glassfish.main.admingui:console-cluster-plugin (3.1.2), org.glassfish.main.admingui:console-common-full-plugin (3.1.2) +6 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (3.1.2)

org.glassfish.main.admingui:console-common MAVEN version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 3.1.2 -...

org.glassfish.main.admingui:console-cluster-plugin (6.2.3), org.glassfish.main.admingui:console-common-full-plugin (6.2.3) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.2.3)

org.glassfish.main.admingui:console-common MAVEN version 6.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.2.3 -...

org.glassfish.main.admingui:console-cluster-plugin (5.1.0), org.glassfish.main.admingui:console-common-full-plugin (5.1.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.1.0)

org.glassfish.main.admingui:console-common MAVEN version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.1.0 -...

org.glassfish.main.admingui:console-cluster-plugin (5.1.0-rc2), org.glassfish.main.admingui:console-common-full-plugin (5.1.0-rc2) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.1.0-rc2)

org.glassfish.main.admingui:console-common MAVEN version 5.1.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.1.0-rc2 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.11), org.glassfish.main.admingui:console-common-full-plugin (7.0.11) +10 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.11)

org.glassfish.main.admingui:console-common MAVEN version 7.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.11 -...

org.glassfish.main.admingui:console-cluster-plugin (7.1.0-m1), org.glassfish.main.admingui:console-commandrecorder-plugin (7.1.0-m1) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.1.0-m1)

org.glassfish.main.admingui:console-common MAVEN version 7.1.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.1.0-m1 -...

org.glassfish.main.admingui:console-cluster-plugin (6.0.0), org.glassfish.main.admingui:console-common-full-plugin (6.0.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.0.0)

org.glassfish.main.admingui:console-common MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.0.0 -...

org.glassfish.main.admingui:console-cluster-plugin (7.0.18), org.glassfish.main.admingui:console-commandrecorder-plugin (7.0.18) +11 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (7.0.18)

org.glassfish.main.admingui:console-common MAVEN version 7.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 7.0.18 -...

org.glassfish.main.admingui:console-cluster-plugin (6.2.0), org.glassfish.main.admingui:console-common-full-plugin (6.2.0) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (6.2.0)

org.glassfish.main.admingui:console-common MAVEN version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 6.2.0 -...

org.glassfish.main.admingui:console-cluster-plugin (5.0.1), org.glassfish.main.admingui:console-common-full-plugin (5.0.1) +9 more potentially affected by CVE-2026-2586 via org.glassfish.main.admingui:console-common (5.0.1)

org.glassfish.main.admingui:console-common MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.glassfish.main.admingui:console-common and may be impacted: - org.glassfish.main.admingui:console-cluster-plugin 5.0.1 -...