CVE-2026-42220 nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired through the X-Node-Secret header or nodesecret...

CVE-2026-42220 nginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired through the X-Node-Secret header or nodesecret...

Malicious code in eslint-csv-galaxy-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd45e16c796e796ce2867f6edaf3c1ecb8afd063eb8315db7cf688fcfe950107 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52568 Malicious code in umi-teh45-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835358879f133d1fc39bc31aedbaecd3ca1203a50b998da89bbea9045097e750 The package umi-teh45-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm...

PYSEC-2018-150

Hyperledger Iroha versions v1.0beta and v1.0.0beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes...