613846 matches found
CVE-2026-65590
Summary: CVE-2026-65590 affects n8n before 2.29.8 and 2.30.x before 2.30.1 due to missing shell sandbox enforcement in the @n8n/computer-use package on Linux/Windows (macOS sandbox exists). It allows shell commands to run with unrestricted filesystem and network access from the computer-use agent...
CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
EUVD-2026-47634
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
ROOT-APP-NPM-CVE-2026-27699 CVE-2026-27699 in @rootio/basic-ftp - Patched by Root
Root has patched CVE-2026-27699 in the @rootio/basic-ftp package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-6V7Q-WJVX-W8WG GHSA-6v7q-wjvx-w8wg in @rootio/basic-ftp - Patched by Root
Root has patched GHSA-6v7q-wjvx-w8wg in the @rootio/basic-ftp package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44240 CVE-2026-44240 in @rootio/basic-ftp - Patched by Root
Root has patched CVE-2026-44240 in the @rootio/basic-ftp package for Root:npm. Multiple fixed versions available...
Malicious code in dev-helper-bg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...
MAL-2026-10992 Malicious code in dev-helper-bg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...
@1delta/aggregators (>=0.1.0, <=0.1.6), @1delta/bridge-configs (>=0.1.0, <=0.1.9) +391 more potentially affected by CVE-2026-45820 via fflate (>=0.8.0, <=0.8.2)
fflate NPM version =0.8.0, =0.1.0, =0.1.0, =0.0.11, =0.0.52, =0.1.0, =0.0.72, =0.1.0, =1.5.3, =0.1.0, =0.13.6, =0.13.6, =0.13.6, =0.1.0, =0.1.1 and more Source cves: CVE-2026-45820 Source advisory: OSV:GHSA-PX8P-9VWX-VF98...
@bugreels/web-script (0.0.9), @dysonic/web-replay-chrome-extensions (>=0.1.0-beta.0, <=0.1.0) +6 more potentially affected by CVE-2026-45820 via fflate (0.4.8)
fflate NPM version 0.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on fflate and may be impacted: - @bugreels/web-script 0.0.9 - @dysonic/web-replay-chrome-extensions =0.1.0-beta.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0, =0.1.0-alpha.0,...
@2gis/deck2gis-layer (>=3.0.0, <=3.0.13), @3cr/viewer-browser (>=0.0.327, <=0.0.333) +719 more potentially affected by CVE-2026-45820 via fflate (>=0.7.1, <=0.7.4)
fflate NPM version =0.7.1, =3.0.0, =0.0.327, =0.0.308, =1.0.29, =0.1.0, =3.0.17, =3.0.0-b.2, =1.3.1-isan.0, =1.3.3-isan.0, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =1.0.1, =2.7.3 and more Source cves: CVE-2026-45820 Source advisory: OSV:GHSA-PX8P-9VWX-VF98...
@polygonjs/plugin-mediapipe-facemesh (>=1.1.1, <=1.1.218), @polygonjs/polygonjs (>=1.1.124, <=1.1.239) +7 more potentially affected by CVE-2026-45820 via fflate (0.6.9)
fflate NPM version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on fflate and may be impacted: - @polygonjs/plugin-mediapipe-facemesh =1.1.1, =1.1.124, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.1, =0.5.0, =1.1.124-1, =1.1.239-1 Source cves:...
MAL-2026-10991 Malicious code in make-helper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...
Malicious code in make-helper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e6560048133cc76a9e325b02b2719f89d59c500d09409bb10b6f4afb14401 On import devhelper, the package's init.py starts a daemon thread that runs decryptor.decryptandrun: it fetches an AES-GCM key from the hardcoded...
CVE-2026-55379 vulnerabilities
Vulnerabilities for packages: openstack-horizon-2025.2-fips, superset, superset-fips, tritonserver-backend-vllm-cuda-13.0, text-generation-inference, tensorflow-gpu-jupyter, openstack-horizon-2026.1, openstack-horizon-2025.2, openstack-horizon-2026.1-fips, open-webui, mlflow, label-studio,...
GHSA-9HW9-CH79-4VH6 vulnerabilities
Vulnerabilities for packages: openstack-horizon-2025.2-fips, superset, superset-fips, tritonserver-backend-vllm-cuda-13.0, text-generation-inference, tensorflow-gpu-jupyter, openstack-horizon-2026.1, openstack-horizon-2025.2, openstack-horizon-2026.1-fips, open-webui, mlflow, label-studio,...
GHSA-PMV8-RQ9R-6J72 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards-fips, lerna, nextcloud-server, librechat, langfuse, opensearch-dashboards, kibana, langfuse-fips, gitlab-rails-ce, redisinsight, azurite, gitlab-rails-ce-fips, awx, arangodb, prism, kubeflow-centraldashboard, jitsucom-jitsu,...
GHSA-42H9-826W-CGV3 vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards-fips, lerna, nextcloud-server, librechat, langfuse, opensearch-dashboards, kibana, langfuse-fips, gitlab-rails-ce, redisinsight, azurite, gitlab-rails-ce-fips, awx, arangodb, prism, kubeflow-centraldashboard, jitsucom-jitsu,...