266080 matches found
Malicious code in @saladin0x1/js-shared-modules (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b34c6719686343f42df5a2257649104f50ac91ae01ac81d34f182075dc943ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview patientdocuments is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in chai-as-byte (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire...
Important: Red Hat Security Advisory: perl-XML-LibXML security update
An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names
A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...
PT-2026-60237
Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron...
PT-2026-60115
n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity...
ALSA-2026:39868 Important: nodejs:24 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...
PT-2026-60252
Name of the Vulnerable Software and Affected Versions FastGPT versions 4.14.17 through 4.15.0-beta4 Description An authenticated user can save a workflow node that references another user's private HTTP toolset by providing a crafted tool ID in the format http-/. While standard toolset routes...
CVE-2026-56353: Improper Authentication
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth a non-default configuration. In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented,...
CVE-2026-59254: Authorization Bypass Through User-Controlled Key
n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without...
RHEL 8 : perl-XML-LibXML (RHSA-2026:39878)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39878 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...
RHEL 9 : perl-XML-LibXML (RHSA-2026:39553)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39553 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...
RHEL 10 : perl-XML-LibXML (RHSA-2026:39547)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39547 advisory. This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module...
PT-2026-60310
Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.32.1 through 0.40.5 Description An issue exists where nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts, parse the node.js mirror's index.tab and use the LTS codenam...
CVE-2026-61643: Incorrect Authorization
FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authenticated FastGPT user can save a workflow node that points to another user's private HTTP toolset by using a crafted saved tool id such as http- / . The normal toolset routes deny access, but the workfl...
CVE-2026-56349: Improper Input Validation
n8n before version 2.10.0 contains an input validation vulnerability in the Guardrail node that allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity...
CVE-2026-15921: Improper Limitation of a Pathname to a Restricted Directory
Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts parse the node.js mirror's index.tab and use each release's LTS...
PT-2026-60131
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.28.1 Description An information disclosure issue exists where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. Authenticated project editors can read plaintext extern...
PT-2026-60190
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an...