255314 matches found
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: azure-service-operator-fips, crossplane-provider-aws-networkmanager-fips, dex-fips, knative-eventing-fips, vault-fips, db-operator, trivy, blob-csi-fips, cert-manager-webhook-pdns, crossplane-provider-aws-kinesis, chaos-mesh-fips, rancher-fleet,...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
GHSA-P88M-4JFJ-68FV vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: actions-runner, kibana, gemini-cli, py3-captum, saf, vitess, pelias-api, node-gyp, renovate, code-server, npm, haraka, prism...
CVE-2026-49261
A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...
MAL-2026-6278 Malicious code in ts-wross (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dae43b7ff77748f10ae5faf6d87b7d63552e5629a37c931ea2c0de3539b469 Package is published under the name ts-wross but its package.json claims authorship by Michael Mclaughlin [email protected] and points its repository...
Malicious code in node-core-libs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d33f74e3f73fd5580ecf994b7db0349ee540754d65d4467b8b04b8c79e3d257b scripts/postinstall.js runs automatically on npm install Windows only and behaves as a classic install-time dropper. It XOR-decodes key 0x5A a...
MAL-2026-6276 Malicious code in node-core-libs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d33f74e3f73fd5580ecf994b7db0349ee540754d65d4467b8b04b8c79e3d257b scripts/postinstall.js runs automatically on npm install Windows only and behaves as a classic install-time dropper. It XOR-decodes key 0x5A a...
Linux Distros Unpatched Vulnerability : CVE-2026-53655
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to the next head...
PT-2026-51508
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description A server-side request forgery SSRF issue exists in the Execute Flow node. This occurs due to missing secureFetch verification in httpSecurity.ts, allowing attackers to bypass security validation by...
GHSA-9M6G-WC8R-Q59C scimPatch vulnerable to prototype pollution via unfiltered keys in patch
Summary scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the Node process. Any service that calls scimPatch on...
CVE-2026-56348 n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with...
EUVD-2026-38376
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with...
CVE-2026-56348 n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with...
EUVD-2026-38367
Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatflows/apikey/:apikey endpoint. When the keyonly query parameter is omitted the default, the endpoint returns not only the chatflows bound to the supplied API key but also all chatflows across every workspace...
