CVE-2026-3093 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-86R3-Q889-HVG2 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-8JC8-CVQJ-P926 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-2RC9-8CX9-FXPR vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-4672 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-6336 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-35PC-QWV6-4858 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-14562 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-12436 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-G9G2-QC64-JGCJ vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-14341 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-94P8-87FF-W336 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

EUVD-2026-52795

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...

MAL-2026-11789 Malicious code in @qlik/embed-react (npm)

npm/@qlik/embed-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @ornikar/typed-css-modules-loader (npm)

npm/@ornikar/typed-css-modules-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

GHSA-6FHJ-CGMM-XFX6 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-6267 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

Malicious code in @onereach/si-a-button (npm)

npm/@onereach/si-a-button is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @onereach/phonenumber-interpreter (npm)

npm/@onereach/phonenumber-interpreter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

PYSEC-2026-3571 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...