Silicon Labs Z-Wave SDK authorization issue vulnerability

Silicon Labs Z-Wave SDK versions 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices contain an authorization issue vulnerability. This vulnerability stems from a lack of validation in the ZWAVECMDNODESEXIST handler, potentially allowing devices already on...

DRUPAL-CONTRIB-2026-235

This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node...

@biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14), @blinkk/root-cms (>=3.5.2, <=4.1.2) +129 more potentially affected by CVE-2026-113657 via sanitize-html (2.17.7)

sanitize-html NPM version 2.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @biztory/n8n-nodes-tableau-rest-api =0.1.13, =3.5.2, =12.3.0-depup.0, =39.0.0, =9.0.2, =0.0.0-dummy.1, =0.29.2, =0.1.0, =0.10.2,...

CVE-2026-77934

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

EUVD-2026-104690

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934

Coze Studio versions before 0.5.0 are affected by an insecure default configuration allowing registered users to perform Remote Code Execution (RCE) . The vulnerability exists because workflow code nodes run in an unsandboxed python3 subprocess , where attackers can bypass regex import filters us...

CVE-2026-77934 Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

PT-2026-117952

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import 'subprocess' to run commands, stealing environment...

Coze-Dev and Coze-Studio: Configuration error vulnerabilities

Versions of coze-dev and coze-studio before 0.5.0 have a configuration error vulnerability. This vulnerability stems from insecure default configurations, allowing any registered user to execute commands in unshaded Python3 subprocedures by running workflow code nodes. Attackers can bypass the...

PT-2026-116777

In the Linux kernel, the following vulnerability has been resolved: net: flush skb defer nodes in dev cpu dead When a CPU goes offline, dev cpu dead drains its softnet queues completion queue, output queue, poll list, process queue, and input pkt queue, but leaves net hotdata.skb defer nodes...

PT-2026-116723

In the Linux kernel, the following vulnerability has been resolved: PCI: of property: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

PT-2026-116876

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio device left registered on PM setup failure pm runtime set active failing in probe jumps to error unreg buffer, which only calls iio triggered buffer cleanup -- it does not undo the iio device...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The issue in fdt: fix off-by-one error in unflattendtnodes Commit 78c44d910d3e “drivers/of: Fix depth when unflattening devicetree” forgot to fix the depth check in the loop body of unflattendtnodes. This could lead to an overflo...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed an issue where inode lists were leaked during backref walking in findparentnodes. During backref walking, when findparentnodes is called, if we are dealing with a data extent and an error occurs while resolving...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: mdiobus: fix unbalanced node reference count I received the following report while performing a devicemscc-miim load test with CONFIGOFUNITTEST and CONFIGOFDYNAMIC enabled: OF: ERROR: memory leak, expected refcount 1 instead...

terra-bonobo-nodes (>=0.1.1, <=0.1.4), terra-common (>=0.2.2, <=0.2.10) +1 more potentially affected by CVE-2026-106443 via weasyprint (57.0.0)

weasyprint PYPI version 57.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - terra-bonobo-nodes =0.1.1, =0.2.2, =0.2.10 - wagtail-meeting-guide 0.1.0.dev9 Source cves: CVE-2026-106443 Source advisory:...

CVE-2026-110848

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...

CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named proto throu...