197 matches found
CLSA-2026-1792449835 TuxCare security update for node-fetch (2 CVEs)
TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.6.0-tuxcare.1...
Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub (Db2IC)
Summary Dependency updates and code fixes were done to fix multiple vulnerabilties found in Db2 intelligence center. Vulnerability Details CVEID:CVE-2026-109838 DESCRIPTION: IBM Db2 Genius Hub could allow a local attacker to obtain sensitive information due to improper verification of cryptograph...
Malware in node-fetch-lite
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-17683 Malicious code in node-fetch-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in node-fetch-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-103757
Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utilities/fileUtils.ts uses raw node-fetch instead of fetchWithBlacklist. Authenticated builder users can send a prompt to POST /api/ai/tables...
CVE-2026-35219
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
EUVD-2026-60381
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
CVE-2026-35219: Server-Side Request Forgery (SSRF)
Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...
GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...
PT-2026-76555
Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...
PT-2026-75931
Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...
CLSA-2026-1775003169 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...
CLSA-2026-1775003170 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1...
CLSA-2026-1775003167 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1...