CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

[R1] Tenable Enclave Security 1.9.0 Fixes Multiple Vulnerabilities

R1 Tenable Enclave Security 1.9.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 08/27/2026 - 12:25 Tenable Enclave Security leverages third-party software to help provide underlying functionality. Several of the third-party components Node.Js, Go were found to contain vulnerabilities, and...

CVE-2026-55553

A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the...

CVE-2026-76845

A flaw was found in adm-zip, a Node.js library used for handling zip archives. This vulnerability allows a local attacker to overwrite arbitrary files on the system. When extracting an archive, adm-zip follows symbolic links, which are special files that point to other files or directories. An...

CVE-2026-75975

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

CVE-2026-75899

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

CVE-2026-47727: Improper Control of Generation of Code

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize the shareTemplate relation because that relation is not marked as dangerous, allowing an attacker-supplied import archive to plant a server-side...

CVE-2026-54732: Improper Limitation of a Pathname to a Restricted Directory

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

PT-2026-82688

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

Linux Distros Unpatched Vulnerability : CVE-2026-76845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the...

The vulnerability in the requestInternal HTTP redirection processing function of the urllib package in the Node.js npm package stack allows attackers to access protected information.

The vulnerability of the requestInternal handling function in the urllib package of the Node.js npm package stack involves exposing confidential information to unauthorized entities. Exploiting this vulnerability could allow a malicious actor to gain access to protected information...

CVE-2026-55553

creationtimestamp| type| source ---|---|--- 2026-08-25 18:35:14+00:00| published-proof-of-concept| https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78...

nodejs:24 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:55603 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:54371 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash...

nodejs:24 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:54530 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash...

CVE-2026-55553

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, requestInternal recursively calls...