MAL-2026-1071 Malicious code in libsignal-skyzopedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b81533378b0d096fcc0993f0ed9354dab8557c619e4a872c6a01c4df07aeedaf The package libsignal-skyzopedia was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1065 Malicious code in @skyzopedia/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2374557a2e5bb837db215803d8633eccba2c9eb2ba8ad4ad709f7e93246e117b The package @skyzopedia/baileys was found to contain malicious code. Source: ghsa-malware...

Malicious code in @skyzopedia/brat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7928fe6b128de0686bbc2619dd9015f58d8f2a38d50911f33d8886b323c6df5 The package @skyzopedia/brat was found to contain malicious code. Source: ghsa-malware 0eb0067d76f7f026901f7d29398dd55485b8fa6a59af7bdbfbdb40d6f97b7e...

MAL-2026-1070 Malicious code in @skyzopedia/ubot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7b890828aacf5b41748819446c1c5d9627b47ea308e06e68ac2b8c3da1b064 The package @skyzopedia/ubot was found to contain malicious code. Source: ghsa-malware f5c54f0d0ad14b598ab988dc3b30f210453e0c0a4e4c6dc9e7fdc98ab95fb7...

Malicious code in express-core-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4917c569276f08ce3f25d5426d0621945c0664c14badaff37739cde37fba05b The package express-core-validator was found to contain malicious code. Source: ghsa-malware...

OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

EUVD-2026-8999

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-28370

OpenStack Vitrage suffers a remote code execution risk in the query parser. In versions prior to 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user with API access can trigger code execution on the Vitrage service host as the service user through the _create_query_function path in vitrage/graph/query.py....

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the osctrl-admin environment configuration. An attacker can execute arbitrary shell commands on every endpoint that enrolls using a compromised environment by injecting commands into the hostname parameter, which ar...

PT-2026-22298

Name of the Vulnerable Software and Affected Versions OpenStack Vitrage versions prior to 12.0.1, 13.0.0, 14.0.0, and 15.0.0 Description A flaw exists in the query parser of OpenStack Vitrage that could allow a user with access to the Vitrage API to trigger code execution on the Vitrage service...

CVE-2026-28370

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

MAL-2026-1047 Malicious code in ts-packer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd7ed1f89788c69596bac0f4e3429cfadc252f8f2e7cc255616c6f63ad63d2eb The package ts-packer was found to contain malicious code. Source: ghsa-malware cf93507187d36aaad21ab48b27cbc91258ef6b442053c36ee60cc01adbe7e8b4 Any...

MAL-2026-1045 Malicious code in jest-node-paramset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0195409dba352b70324fae3226921105e7658404675e2b9e8ab1e898c5bd84fa The package jest-node-paramset was found to contain malicious code. Source: ghsa-malware...

Malicious code in jest-node-paramset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0195409dba352b70324fae3226921105e7658404675e2b9e8ab1e898c5bd84fa The package jest-node-paramset was found to contain malicious code. Source: ghsa-malware...

Malicious code in ts-packer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd7ed1f89788c69596bac0f4e3429cfadc252f8f2e7cc255616c6f63ad63d2eb The package ts-packer was found to contain malicious code. Source: ghsa-malware cf93507187d36aaad21ab48b27cbc91258ef6b442053c36ee60cc01adbe7e8b4 Any...

Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited Since 2023 for Admin Access

A newly disclosed maximum-severity security flaw in Cisco Catalyst SD-WAN Controller formerly vSmart and Catalyst SD-WAN Manager formerly vManage has come under active exploitation in the wild as part of malicious activity that dates back to 2023. The vulnerability, tracked as CVE-2026-20127 CVSS...

CVE-2026-27970 Angular i18n vulnerable to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...