AZL-95943 CVE-2026-13622 affecting package kubevirt 1.8.4-2

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

CVE-2026-13622

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

DRUPAL-CONTRIB-2026-099

This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...

Malicious Package

Overview @years19/n8n-nodes-utils-helper-o is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2026-13907 Malicious code in @years19/n8n-nodes-utils-helper-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3601885350a7fc85f418da9fb3f800a5e76949562ad23ac44d5c2b068088c4 The package's postinstall hook runs node callback.js, and package.json declares main=index.js which is byte-identical to callback.js, so both npm...

Malicious code in @years17/n8n-nodes-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64819454fc9d9904917336a6e36102f0925718ad2f4eab2d6673d75ff68fe777 Package ships a malicious n8n community node with three independent installer-harm paths. 1 package.json declares a postinstall script that shells ou...

MAL-2026-13870 Malicious code in @years17/n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f2f873930574335cddd8ac2a79b3c811b317f636d08c8dd218dae63a8ce8d2 The package's postinstall script also executed on require via index.js runs a series of host reconnaissance commands id, hostname, uname -a, docker...

Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, dock...

MAL-2026-13877 Malicious code in @years17/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba5b7d9e03a0f3796945ee4c55a6f32169b8f32b794dad9c1b450883667116b The package's postinstall script executes callback.js, which runs host reconnaissance id, hostname, uname -a, directory listings, sudo -n check, dock...

Malicious code in @years17/n8n-nodes-utils-helper-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af9f56bdea8e3bb900e25683a669d233760c33c4b028dd03ede76a2114682096 On install, this package auto-executes callback.js via a postinstall hook identical to index.js. The script appends a hardcoded attacker ssh-ed25519...

Malicious code in @years17/n8n-nodes-utils-helper-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b182b8002a439754289ce8bf403fd3c19500fe37a2dde7e7106501d814cbcb8 The package's postinstall script duplicated in index.js runs automatically on npm install and performs three malicious actions: 1 executes...

Malicious code in @years18/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804 Package advertises itself as an n8n community utility-node helper but its postinstall hook node callback.js fetches two tarballs from jasabersama.id...

MAL-2026-13861 Malicious code in @years18/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...

Malicious code in @noxzacode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3082addf9f38493a38854287a70c75981ded28e693bf391917600680276a1ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13781 Malicious code in @noxzacode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3082addf9f38493a38854287a70c75981ded28e693bf391917600680276a1ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @noxzacode/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.12.1 security update

This is an updated version of the Node Health Check Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Node Health Check Operator deploys the Node Health Check controller. The controller identifies unhealthy nodes and uses a remediation provider to remediate the...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.7.1 security update

This is an updated version of the Machine Deletion Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Machine Deletion Remediation MDR Operator works with the Node Health Check NHC Operator to reprovision unhealthy nodes using the Machine API. The MDR...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability Operator v0.13.1 security update

This is an updated version of the Self Node Remediation Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Self Node Remediation Operator works in conjunction with the machine health check or the node health check to provide automatic remediation of unhealthy nodes by...

Important: Red Hat Security Advisory: Red Hat OpenShift Workload Availability v5.7.1 security update

This is an updated version of the Node Maintenance Operator. This Operator is delivered by Red Hat Workload Availability RHWA. The Node Maintenance Operator works in conjunction with the machine health check or the node health check to provide automatic remediation of unhealthy nodes by rebooting...