CVE-2026-21637 vulnerabilities

Vulnerabilities for packages: nodejs...

OpenProject data falsification vulnerability

OpenProject is an open-source web-based project management software. In versions 17.0.0 to 17.0.2 of OpenProject, there was a data manipulation vulnerability. This vulnerability stemmed from the BlockNote editor extension not properly verifying work package IDs, allowing arbitrary GET requests to...

CVE-2022-40620

FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update packages through its auto-update mechanism. An attacker suitably positioned on the network could intercept the update request and deliver a...

Oracle Linux 9 : python3.11 (ELSA-2026-1410)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-1410 advisory. - Security fix for CVE-2025-13836 Resolves: RHEL-141025 Tenable has extracted the preceding description block directly from the Oracle Linux security...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +311 more potentially affected by CVE-2025-59471 via next (>=15.6.0-canary.41, <=16.1.4)

next NPM version =15.6.0-canary.41, =0.1.0, =1.0.0, =0.3.128, =1.0.0-canary.3, =0.1.0, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.1.0, =0.1.0, =1.0.4186, =1.0.4319 and more Source cves: CVE-2025-59471 Source advisory: OSV:GHSA-9G9P-9GW9-JX7F...

GHSA-RF7G-F56C-V6W4 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +338 more potentially affected by CVE-2026-24473 via hono (>=4.0.0, <=4.11.6)

hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =1.8.0 and more Source cves: CVE-2026-24473 Source advisory: SNYK:JS-HONO-15123868...

@kyuda/n8n-nodes-databricks (>=2.0.0, <=2.0.6), @kyuda/n8n-nodes-databricks-simplified (1.0.0) +14 more potentially affected by CVE-2026-1470 via n8n-workflow (>=2.0.0, <=2.4.2)

n8n-workflow NPM version =2.0.0, =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.4.2 - n8n-nodes-cheerio-html-parser 0.5.9 and more Source cves: CVE-2026-1470 Source advisory:...

@n8n/ai-workflow-builder (1.5.0), @n8n/api-types (1.5.0) +10 more potentially affected by CVE-2026-1470 via n8n-workflow (2.5.0)

n8n-workflow NPM version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-workflow and may be impacted: - @n8n/ai-workflow-builder 1.5.0 - @n8n/api-types 1.5.0 - @n8n/backend-common 1.5.0 - @n8n/backend-test-utils 1.5.0 - @n8n/db 1.5.0 -...

CVE-2026-24131

A flaw was found in pnpm, a package manager. When pnpm processes the directories.bin field of a package, it fails to properly validate the path, allowing a malicious npm package to specify a crafted path. This directory traversal vulnerability enables the package to escape its intended directory...

CVE-2026-23890

A flaw was found in pnpm, a package manager. A remote attacker can exploit a path traversal vulnerability by crafting malicious npm packages. This vulnerability allows the attacker to bypass validation by using bin names starting with an "@" symbol, enabling them to create executable shims or...

Bun security vulnerabilities

Bun is an open-source toolkit developed by Bun developers, designed for use with JavaScript and TypeScript applications. Versions of Bun prior to 1.3.5 contained a security vulnerability. This vulnerability stemmed from the default trusted dependency list being susceptible to being exploited by...

Linux Distros Unpatched Vulnerability : CVE-2026-22795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS12 file. Impact summary: An application processing...

Linux Distros Unpatched Vulnerability : CVE-2026-1484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the...

Debian: Security Advisory (DLA-4457-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MiracleLinux 8 : go-toolset:rhel8 (AXSA:2026-084:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-084:01 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-22262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network IDS, IPS and NSM engine. While saving a dataset a stack buffer is used to prepare the data. Prior to versions 8.0.3 and 7.0.14, if the dat...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-24131 via @pnpm/package-bins (>=1000.0.0, <=1000.0.16)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.3.0 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-24131 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15102727...

47th (0.1.0), @0xchain/auth (>=0.0.1, <=1.1.0-beta.7) +210 more potentially affected by CVE-2025-55184 +1 more via next (>=15.5.0, <=15.5.9)

next NPM version =15.5.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-NEXT-15921797...

CVE-2026-23864

CVE-2026-23864 affects React Server Components packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The connected advisories describe a denial-of-service condition triggered by specially crafted HTTP requests to Server Function endpoints, potentially causin...