UBUNTU-CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

Flowise: File Upload Validation Bypass in createAttachment

Summary In FlowiseAI, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally allow JavaScript uploads. This enables attackers to persistently store malicious...

CVE-2026-22696

dcap-qvl implements the quote verification logic for DCAP Data Center Attestation Primitives. A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Identity collateral including qeidentity,...

MAL-2025-107968 Malicious code in responsible_aardwolf_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6a9ec1ffb9852d245687b79f59cd345d6efac4ce6649a13046051ae64f81588 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-40908

Name of the Vulnerable Software and Affected Versions Flowise version 3.0.7 Description Flowise, a drag & drop user interface for building customized large language model flows, contains a file upload issue. Authenticated users can upload arbitrary files without proper validation, enabling...

Malicious code in epc-node-web-client (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6926 Malicious code in epc-node-web-client (npm)

The package communicates with a domain associated with malicious activity...

Malicious Package

Overview tree-node-web is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...