Unspecified Vulnerability in HCL AION (CNVD-2026-16406)

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a security vulnerability that is caused due to improper handling of host headers that enable host header injection. An attacker can exploit the vulnerability to allow malicious file uploads, resulting in...

MAL-2026-584 Malicious code in chai-as-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1dda9ad39b1f120fc9fe5a856dbc209c2441a9c6de305ae72a35ec94ef31862 The package chai-as-extended was found to contain malicious code. Source: ghsa-malware c852649226583defd7fce57e5a82645ae50eeff8376ea06c070170b31c0a66...

Malicious code in chai-async-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fe54f3f00b12c9b57fd672be7ddbe4a46342c24fe308c31f31c6156ae436d8b The package chai-async-tests was found to contain malicious code. Source: ghsa-malware 4303ac7ff339f51dfbc53ed8c70cd02a76123b62e0448bca935128fd313ab3...

MAL-2026-586 Malicious code in chai-chains-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f83118d80cc6575c1c629c8591ed8a6a7a34ea03591cb737cdfb6ac45f0738 The package chai-chains-async was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-chains-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f83118d80cc6575c1c629c8591ed8a6a7a34ea03591cb737cdfb6ac45f0738 The package chai-chains-async was found to contain malicious code. Source: ghsa-malware...

Malicious code in somsodamsd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 437d384f1bedaaf93abee9ecf1219d3244c96b0086ec0ed005374d28fb9d4522 The package somsodamsd was found to contain malicious code. Source: ghsa-malware ffb9c516d18ccedc5e8858843b9cfe1507126bf2d577896d21391b4f0d211a9c Any...

MAL-2026-580 Malicious code in somesomesome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ac4cdf90f62b12288a57c534bcb83bc35de128259f75f906169c33813dfba2 The package somesomesome was found to contain malicious code. Source: ghsa-malware d1683803620919909c2838f7003b5c93054230dba6b2f347314ffd3e78b405c4 A...

Malicious code in teslaone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abb43567bb439e05bc83e1c5606aea8567e811514d05c3fa914204631fc8d762 The package teslaone was found to contain malicious code. Source: ghsa-malware fdac9959b37ff7705cf813ced160feeae858ef6da9e1ec58b3d0f33f0ceda520 Any...

Malicious code in ern-picking2-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdd28d37200aac1cd5fc446acddca1c77227c48fbccf070f31a765422439184 The package ern-picking2-api was found to contain malicious code. Source: ghsa-malware 6d206018d9dd4cfb8e95bc0197ea0db4d442ee3b16f5209a2b452bc203dc8d...

MAL-2026-569 Malicious code in ern-picking2-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdd28d37200aac1cd5fc446acddca1c77227c48fbccf070f31a765422439184 The package ern-picking2-api was found to contain malicious code. Source: ghsa-malware 6d206018d9dd4cfb8e95bc0197ea0db4d442ee3b16f5209a2b452bc203dc8d...

MAL-2026-568 Malicious code in equimper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 174afe3f7c17abcec63d8bfa72500c726f7e7cc7a5b9f726c387f5e9c5399287 The package equimper was found to contain malicious code. Source: ghsa-malware 239809818f810ae94c81e006270640279952fcd3123a3e4da631e6810f4ed4de Any...

MAL-2026-558 Malicious code in n8n-zalo-fevox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebd654ee6bdaaccbd6904ea6d3c5f66219853ee17690b9869800d4ea8ecd6c98 The package n8n-zalo-fevox was found to contain malicious code. Source: ghsa-malware 82aefb1c447eeed101d3038ddd37d6ad6e913375d834a7c8ed9ff3d3eae4e0f4...

MAL-2026-557 Malicious code in n8n-nodes-zalo-fevox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef5385f68a1dbba64d28aa388e3b9c2ad04f564b853ebee07e9422cac623662 The package n8n-nodes-zalo-fevox was found to contain malicious code. Source: ghsa-malware...

Malicious code in transform-async-to-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3375385fb6c066445341256f9ce616582a713468ea0649853056c24b4aaf1776 The package transform-async-to-generator was found to contain malicious code. Source: ghsa-malware...

Malicious code in syntax-async-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d14dae07d53bcd3b3da9693bf5facb7518fafafe8cc2c54d93cd59ec7a28f1 The package syntax-async-functions was found to contain malicious code. Source: ghsa-malware...

MAL-2026-559 Malicious code in syntax-async-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d14dae07d53bcd3b3da9693bf5facb7518fafafe8cc2c54d93cd59ec7a28f1 The package syntax-async-functions was found to contain malicious code. Source: ghsa-malware...

CVE-2026-1470

n8n contains a critical Remote Code Execution RCE vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An...

CVE-2026-1470 Authenticated users can bypass the Expression sandbox mechanism to achieve full remote code execution on n8n’s main node.

n8n contains a critical Remote Code Execution RCE vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An...

Malicious code in stylus.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da337331b168fe53efb22dcc1d3a935e35010e59a40d5d222ee18aa89fe82e42 The package stylus.js was found to contain malicious code. Source: ghsa-malware 228752dfb0c639ecaabfe0fc0189046c016a56e66ffae8ebb59eaeb675d9d935 Any...

MAL-2026-542 Malicious code in stylus.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da337331b168fe53efb22dcc1d3a935e35010e59a40d5d222ee18aa89fe82e42 The package stylus.js was found to contain malicious code. Source: ghsa-malware 228752dfb0c639ecaabfe0fc0189046c016a56e66ffae8ebb59eaeb675d9d935 Any...