MAL-2026-1168 Malicious code in @global-dax-ad-platform/dax-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeeb3492b32dc3cc2ca7fc34a813cc711822c435fe3bdab4e1eb21816d75ee8f The package @global-dax-ad-platform/dax-styles was found to contain malicious code. Source: ghsa-malware...

Linux Distros Unpatched Vulnerability : CVE-2026-28370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the...

Malicious code in @sanzxcode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15bab1682cf8fc2aaa7d7f45b24bd1bf279b1e823e8f1c59f6def120297bccc0 The package @sanzxcode/baileys was found to contain malicious code. Source: ghsa-malware...

Malicious code in ngaturkids (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d589b956682ee26f10996c8dd1b6050d8b9e74e7084a46d8f37ab95f7f7fc3fa The package ngaturkids was found to contain malicious code. Source: ghsa-malware 0dc4b2edbc73fc30831d28dd9a701e650e00edefc7938de256932daff4c42577 Any...

MAL-2026-1125 Malicious code in @yaoii-bails/libsignall-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5e3f8a6510eddfe59ab8b6e22c62731e2563f000fd76db05ad293e27d14eed6 The package @yaoii-bails/libsignall-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1113 Malicious code in typoriem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e473ba3785bff62ce2994c6f09309570eea69282acc5438f015d85ca0e61cf5c The package typoriem was found to contain malicious code. Source: ghsa-malware 4dfd9fb9cb096af0fd4d1db216d08d1ae5592ef63c0c97c66a491b00ebdde43e Any...

MAL-2026-1078 Malicious code in socket-dgxeon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b1cdce1957669bd7cca7bb7c90b018a87fad6ed9ea49b4874f127272f0c00d The package socket-dgxeon was found to contain malicious code. Source: ghsa-malware 0f36366d3dd38134f3c8176992483c8c67f2e502ca9b774a4ea5a3fc2d428efc...

MAL-2026-1074 Malicious code in dgxeon-soket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc1fe5368b07366735c8e9f8163262c8e77e1be50c66c9158459b89cf348cac The package dgxeon-soket was found to contain malicious code. Source: ghsa-malware 7814fe539784c04cc6450ee43c3902eab63d439030fa47b7678ccb32e8655119 A...

Malicious code in @skyzopedia/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2851df7c45fca156556e4b7c5fef4c60ed254a43c4e6e51c6e02d8b5ca5a20 The package @skyzopedia/libsignal-node was found to contain malicious code. Source: ghsa-malware...

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

EUVD-2026-8999

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-28370

OpenStack Vitrage suffers a remote code execution risk in the query parser. In versions prior to 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user with API access can trigger code execution on the Vitrage service host as the service user through the _create_query_function path in vitrage/graph/query.py....

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

PT-2026-22298

Name of the Vulnerable Software and Affected Versions OpenStack Vitrage versions prior to 12.0.1, 13.0.0, 14.0.0, and 15.0.0 Description A flaw exists in the query parser of OpenStack Vitrage that could allow a user with access to the Vitrage API to trigger code execution on the Vitrage service...

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-27495

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary code outside the sandbox boundary. On...

CVE-2026-27495 n8n has a Sandbox Escape in its JavaScript Task Runner

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary code outside the sandbox boundary. On...

n8n has a Sandbox Escape in its JavaScript Task Runner

Impact An authenticated user with permission to create or modify workflows could exploit a vulnerability in the JavaScript Task Runner sandbox to execute arbitrary code outside the sandbox boundary. On instances using internal Task Runners default runner mode, this could result in full compromise...