CVE-2026-87029 vulnerabilities

Vulnerabilities for packages: kibana, node-gyp...

GHSA-4QV8-2P9J-2685 vulnerabilities

Vulnerabilities for packages: lerna, node-gyp, vitess, prism...

CVE-2026-109924 vulnerabilities

Vulnerabilities for packages: lerna, node-gyp, vitess, prism...

CVE-2026-109841 vulnerabilities

Vulnerabilities for packages: lerna, node-gyp, vitess, prism...

GHSA-F72V-6W45-Q472 vulnerabilities

Vulnerabilities for packages: lerna, node-gyp, vitess, prism...

CVE-2026-109869 vulnerabilities

Vulnerabilities for packages: lerna, node-gyp, vitess, prism...

GHSA-XJJ6-F33Q-929C vulnerabilities

Vulnerabilities for packages: lerna, node-gyp, vitess, prism...

CVE-2026-116584 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...

CVE-2026-116584 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...

CVE-2026-116584

The Seroval library (versions 1.4.1 through 1.6.8 ) is vulnerable to a denial of service via the fromJSON and fromCrossJSON functions. The root cause is a failure to validate the element list length of array nodes, allowing an attacker to provide a crafted payload with an artificially large lengt...

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052 Missing Authentication for Node-RED in boneIO

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

EUVD-2026-109947

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

CVE-2026-77052

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path via a Caddy reverse proxy. An unauthenticated attacker on the local network can exploit the Node-RED Admin API to deploy malicious flows, leading to remote code execution and full control over the home automatio...

ROOT-APP-NPM-CVE-2026-48988 CVE-2026-48988 in markdown-it - Patched by Root

Root has patched CVE-2026-48988 in the markdown-it package for Root:npm. Multiple fixed versions available...

Malicious code in @greenlake/context-pane (npm)

@greenlake/context-pane is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.0 has a postinstall script that runs node beacon.cjs on npm instal...

PT-2026-123293

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

PT-2026-123357

boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary system commands. An unauthenticated attacker on the local network can deploy a malicious flow to achieve...

Malicious code in event-bus-lite-testmetest (npm)

Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs node index.js during the automatic node-gyp rebuild triggere...