Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

ManageEngine - Remote Command Execution

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec aka XML Security for Java 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security...

EUVD-2026-84947

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...

EUVD-2026-84960

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere...

EUVD-2026-84972

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84974

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-84977

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...

PT-2026-97264

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

PT-2026-97543

Name of the Vulnerable Software and Affected Versions automation-controller affected versions not specified Description An input-validation flaw exists in the sanitize jinja function. The function employs two regular expressions to reject user-supplied Jinja, but these patterns stop at the first...

PT-2026-97595

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

Linux Distros Unpatched Vulnerability : CVE-2026-93012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches...

PT-2026-97668

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

PT-2026-97240

Name of the Vulnerable Software and Affected Versions CGServiSign affected versions not specified Description An OS Command Injection flaw exists in CGServiSign. Unauthenticated remote attackers can trick victims into visiting a malicious web page to inject arbitrary operating system commands...

PT-2026-97578

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description An unauthenticated remote attacker can provide specially crafted input that is incorporated into OS commands, leading to arbitrary command execution on the underlying system. Successful...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

PT-2026-97357

Name of the Vulnerable Software and Affected Versions web.py version 0.76 Description Server-side template injection SSTI occurs when the template engine is tricked into executing attacker-controlled template code, bypassing built-in security checks. This happens when an application precompiles...

TencentOS Server 4: libvirt (TSSA-2026:1048)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...