Malicious Package

Overview n8n-nodes-data-transformer-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview n8n-nodes-healthmon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview n8n-nodes-metricsagent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

CVE-2026-59940

A flaw was found in Seroval, a JavaScript JS value stringification library. The seroval.fromJSON function allows a remote attacker to provide specially crafted JSON Promise control nodes. These nodes can operate on deserialized values without proper verification, leading to unintended server-side...

CVE-2026-62182 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled...

CVE-2026-62371

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

CVE-2026-62371 KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

aetherdsp-core (>=0.1.0, <=0.1.6), aetherdsp-manifest (>=0.1.0, <=0.1.2) +121 more potentially affected by unknown CVE via ringbuf (>=0.1.9, <=0.4.8)

ringbuf CARGO version =0.1.9, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.2.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0293...

PT-2026-96168

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.12.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 through 1.23.0 Description The v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticate...

CVE-2026-62371: Improper Neutralization of Special Elements used in an OS Command

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated...

PT-2026-95410

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The net icmpv6 send error function in subsys/net/ip/icmpv6.c fails to implement all RFC 4443 section 2.4 suppression rules, which dictate that an ICMPv6 error should not be answered with anoth...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92935 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92935 Source advisory: SNYK:JS-VM2-20043635...

CVE-2026-92816

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816

ComfyUI versions before 0.30.0 contain a path traversal vulnerability in dataset save nodes (comfy_extras/nodes_dataset.py). The folder_name input is not properly sanitized, allowing an attacker to write files to arbitrary paths outside the intended output directory. By loading a crafted workflow...

EUVD-2026-81074

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

EUVD-2026-81051

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

PT-2026-94065

Name of the Vulnerable Software and Affected Versions Coze Studio versions prior to 0.5.2 Description Authenticated attackers can execute SQL statements against memory databases of other workspaces to read, insert, or delete data. This occurs because the software fails to validate that table name...