Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

The Cloud module enables users to manage cloud resources through Drupal. The module does not sufficiently sanitize user-controlled Git branch and repository URL values before passing them to shell commands in the Kubernetes integration. This vulnerability allows an attacker to execute arbitrary...

Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

PT-2026-97667

Name of the Vulnerable Software and Affected Versions Drupal Cloud versions 0.0.0 through 7.0.1 Description Improper certificate validation in the Kubernetes and VMware integrations allows an Adversary in the Middle AiTM attack. The module fails to properly validate TLS certificates when connecti...

CVE-2026-16672

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-16468

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...

CVE-2026-16469

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17102

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16346

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

Malicious code in auclean (PyPI)

Source: kam193 b337040219fb9c972fb5437f3546e662ba42d292657ad100b875c6224f152e71 During installation, the package executes embeded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to...

CVE-2026-17102 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17102 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17102

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an OS command injection vulnerability (CVE-2026-17102 ). A remote authenticated attacker could exploit this by taking advantage of the improper neutralization of special elements used in an OS command, potentially leading to the executi...

CVE-2026-16672 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-16672 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-16672

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to remote code execution. A remote authenticated attacker can execute arbitrary code due to the improper neutralization of special elements used in an OS command . The CVSS v3.1 score is 8.8 (High) , indicating significant impact o...

CVE-2026-16469 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16469 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16469

The IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime is vulnerable to an issue where a remote authenticated attacker could execute arbitrary commands. This is caused by the improper neutralization of special elements used in an OS command . The CVSS 3.1 score is 8.8 (High) with a network at...

CVE-2026-16468 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...