325801 matches found
Malicious code in @years20/n8n-nodes-utils-helper-g (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...
Malicious code in @years20/n8n-nodes-utils-helper-i (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...
Malicious code in @years20/n8n-nodes-utils-helper-h (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...
CVE-2026-15803
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...
CVE-2026-15803
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...
EUVD-2026-57314
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...
CVE-2026-54183 Apache Airflow: Airflow Variables were not masked in the UI for authenticated users
Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...
CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...
CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints
Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...
CVE-2026-68971
Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...
CVE-2026-18536
A flaw was found in Data-Entropy. This component reads remote entropy randomness sources over unencrypted HTTP. An on-path attacker, such as one on an open Wi-Fi network or a compromised internet service provider ISP, can intercept and alter the responses from these sources. This allows the...
CVE-2026-73088
A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the...
CVE-2026-73288
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/objectlock/objectlocksys.rs lets checkobjectlockfordeletion, deleteprefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin...
CVE-2026-68756
A party with write access to stored session data may affect JFrog Artifactory under specific conditions...
CVE-2026-66377
An unauthenticated user may access restricted repository information under specific conditions...
SQL Injection
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...
SQL Injection
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...
CVE-2026-47233
Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...
CVE-2026-65926 Private Release Bundle versions may be disclosed under specific configurations
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known...