MAL-2026-1031 Malicious code in react-svg-helper-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39fb02f7b438a7ec942c0fa38a79d9d1c8014a7747696a55445376fce8f8d721 The package react-svg-helper-fast was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1030 Malicious code in chai-as-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11787dc50e16838c5d9f467010f0aaef81b3e55e916c4dd5d3fc811375994e6c The package chai-as-utils was found to contain malicious code. Source: ghsa-malware eb4208b63fd6e66931d39f1a2cd30193e87a717ce9c3ab68e5fce787d0ffdc78...

MAL-2026-1032 Malicious code in sample-custom-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade5f035c4d3f9fe74cfc0626c8ac011eeea6e88040376a03abee9cdf05290b7 The package sample-custom-component was found to contain malicious code. Source: ghsa-malware...

USN-8059-3: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SMB network file system; CVE-2025-22037, CVE-2025-37899...

PT-2026-22029

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22 Description An authenticated user with permission to create or modify workflows could exploit the Python Code node to escape the sandbox. The sandbox did n...

PT-2026-36154

Name of the Vulnerable Software and Affected Versions gnutls affected versions not specified Description A logic error exists in how the software processes multi-record Online Certificate Status Protocol OCSP responses—a protocol used to check the revocation status of digital certificates. A remo...

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

Summary The application allows users to set weak passwords e.g., 1234, password without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account via brute-force or credential stuffing can mainta...

PT-2026-22030

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.10.1 n8n versions prior to 2.9.3 n8n versions prior to 1.123.22 Description n8n is an open source workflow automation platform. An authenticated user with permission to create or modify workflows could exploit a weaknes...

The vulnerability of the n8n automation platform, related to synchronization errors when using a shared resource, allows a hacker to read any files on the host where n8n is running, leading to a complete compromise of the system.

The vulnerability of the n8n automation platform is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows a malicious actor to read any files on the host where n8n is running, which can lead to a complete compromise of the system...

CVE-2026-26351

GetSimpleCMS Community Edition CE versions prior to 3.3.22 3.3.16 tested contains a stored cross-site scripting XSS vulnerability in the Theme to Components functionality within components.php. User-supplied input provided to the "slug" field of a component is stored without proper output encodin...

CVE-2026-27593

Statmatic is a Laravel and Git powered content management system CMS. Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid...

CVE-2026-26222 DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE

Altec DocLink now maintained by Beyond Limits Inc. version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require authentication and is vulnerable to unsafe object unmarshalling,...

Malicious code in @protonme/routing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e618f44597f1625955e5cafd982eed4bc5eea13d53fb57c344daf811fdb6924 The package @protonme/routing was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1024 Malicious code in @protonme/routing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e618f44597f1625955e5cafd982eed4bc5eea13d53fb57c344daf811fdb6924 The package @protonme/routing was found to contain malicious code. Source: ghsa-malware...

Malicious code in @unitedcapitalfinancialadvisors/finlife-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 158b79753c39be97f6436dd06b4ef12321c0419a81070690604105af362334d3 The package @unitedcapitalfinancialadvisors/finlife-component-library was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1025 Malicious code in @unitedcapitalfinancialadvisors/finlife-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 158b79753c39be97f6436dd06b4ef12321c0419a81070690604105af362334d3 The package @unitedcapitalfinancialadvisors/finlife-component-library was found to contain malicious code. Source: ghsa-malware...

Malicious code in @coinmetro/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8710d0b7801eb38be3efb787ab05f7dde1bf3d8e16e645c2b587fc6af19a60b1 The package @coinmetro/app was found to contain malicious code. Source: ghsa-malware 298d5aea9a95bac11ef6a844456d1e9144166fa3eb0885775e41a79b1c8319b6...

MAL-2026-1023 Malicious code in @kiukicom/sidebar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cb39359f91f7a9efe145c20140da0ac4320a6fcce0335e8619af25bcd76c3af The package @kiukicom/sidebar was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1021 Malicious code in @atg-aml-shared/kyc-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669af5ff086209bd01c2d69a805bb4272ccedbc54a1a1c0ce79b0794dc92daea The package @atg-aml-shared/kyc-domain was found to contain malicious code. Source: ghsa-malware...

Malicious code in @atg-aml-shared/kyc-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669af5ff086209bd01c2d69a805bb4272ccedbc54a1a1c0ce79b0794dc92daea The package @atg-aml-shared/kyc-domain was found to contain malicious code. Source: ghsa-malware...