CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-20352 Cisco Identity Services Engine RADIUS Denial of Service Vulnerability

A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this...

CVE-2026-20352

CVE-2026-20352 affects the RADIUS feature of Cisco Identity Services Engine (ISE) . The root cause is improper handling of certain RADIUS requests, allowing an unauthenticated, remote attacker to send a crafted RADIUS request directly to the device and trigger a denial of service that renders the...

EUVD-2026-81121

A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this...

CVE-2026-20176 Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to...

CVE-2026-69200

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

CVE-2026-68904

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...

NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua-transport versions = 2.0.0, 2.170.0...

NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua-client versions = 2.0.0, 2.170.0...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +57 more potentially affected by CVE-2026-68904 via node-opcua-transport (>=2.10.0, <=2.169.0)

node-opcua-transport NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +55 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation FIN-WAIT-2 state during automatic reconnection, leading to memory exhaustion and eventual container/process crash OOM kill. The issue is triggered by the default configuration keepSessionAlive: true when...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +55 more potentially affected by CVE-2026-68904 via node-opcua-client (>=2.10.0, <=2.169.0)

node-opcua-client NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua versions = 2.0.0, 2.170.0...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +47 more potentially affected by CVE-2026-68904 via node-opcua (>=2.1.9, <=2.169.0)

node-opcua NPM version =2.1.9, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +47 more potentially affected by CVE-2026-68904 via node-opcua (>=2.1.9, <=2.169.0)

node-opcua NPM version =2.1.9, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves:...

@cbsanal/node-red-opcua-browse-subscribe (>=0.0.1, <=0.0.4), @frangoteam/fuxa (>=1.1.7, <=1.3.1) +57 more potentially affected by CVE-2026-68904 via node-opcua-transport (>=2.10.0, <=2.169.0)

node-opcua-transport NPM version =2.10.0, =0.0.1, =1.1.7, =1.1.19, =1.3.2-alpha.86, =1.4.15-alpha.218, =1.4.15-alpha.66, =1.4.15-alpha.183, =1.4.15-alpha.61, =1.3.6-alpha.36, =1.4.15-alpha.159, =1.3.5, =1.4.15-alpha.197, =1.4.15-alpha.279, =1.4.15-alpha.182, =1.4.15-alpha.196 and more Source cves...

GHSA-R2PF-9CW4-5J65 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

SUMMARY ------- A combination of bugs in node-opcua causes unlimited TCP socket accumulation FIN-WAIT-2 state during automatic reconnection, leading to memory exhaustion and eventual container/process crash OOM kill. The issue is triggered by the default configuration keepSessionAlive: true when...

CVE-2026-68904

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses...