Malicious code in n8n-nodes-healthmon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and...

MAL-2026-16444 Malicious code in n8n-nodes-healthmon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6e9b877fe50a6a5cdf3cd0af73e755973a6eecb2940424618a5edfdc9443ed n8n-nodes-healthmon ships as a purported n8n health-monitoring node but its index.js binds an HTTP server on 0.0.0.0:41111 that reads a JSON body and...

Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

EUVD-2026-84960

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere...

EUVD-2026-84947

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...

EUVD-2026-84977

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84974

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-80425: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-84714: Incomplete List of Disallowed Inputs

A flaw was found in the automation-controller input-validation guard sanitizejinja. The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '' or '%' character, so a Jinja expression containing an inner brace for example an empty dict i...

CVE-2026-79310: Improper Control of Generation of Code

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

PT-2026-97668

Name of the Vulnerable Software and Affected Versions Drupal Cloud versions 0.0.0 through 7.0.1 Description An OS Command Injection issue exists in the Cloud module, which allows users to manage cloud resources. The module fails to sufficiently sanitize the Git branch and repository URL values...

EUVD-2026-85403

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

TencentOS Server 4: libvirt (TSSA-2026:1048)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-15027: Improper Neutralization of Special Elements used in an OS Command

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

PT-2026-97264

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...