PT-2026-91427

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description IBM DataStage allows a remote authenticated attacker to execute arbitrary commands on the operating system due to OS command injection, a flaw where an attacker can inject malicio...

PT-2026-91161

Name of the Vulnerable Software and Affected Versions Bifrost HTTP transport versions prior to 2.1.0 Description Bifrost allows the registration of MCP clients through its management API, where a stdio client consists of a command and arguments. The software starts the program in the gateway...

PT-2026-91723

Name of the Vulnerable Software and Affected Versions IBM i Access Family versions 1.1.2.0 through 1.1.9.15 Description An authenticated user can execute arbitrary commands with normal user privileges on the system. This occurs due to improper validation of user-supplied input within a session...

PT-2026-91070

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

Palo Alto Networks GlobalProtect App Command Execution

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to the use of an unreliable search path. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

MiracleLinux 9 : gpsd-minimal-3.26.1-2.el9_8.2 (AXSA:2026-1819:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1819:03 advisory. gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility CVE-2026-60122 Tenable has extracted the preceding description block directl...

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco AsyncOS software for Cisco Secure Email Gateway SEG contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Cisco Secure_Firewall_Management_Center

CVE-2026-20079 Cisco FMC Read-Only Checker A small, deliberat...

Malicious code in jest-stable (npm)

Source: amazon-inspector d02daf523039c3df603f4e65bf270eab31b72c3d891d9be87a53c99c77950bfa The package jest-stable was found to contain malicious code. Source: ossf-package-analysis 36fdf22841fdc23172663c2bad33f8d73a6cfd02e64528502f4c1e2c43cae932 The OpenSSF Package Analysis project identified...

Malicious code in jest-cucumber-reporter (npm)

Source: ossf-package-analysis e2fbf023b3a861ceda4ee89f2c188d2cf7e1b274a07fb7f0df58b9d86c6935b2 The OpenSSF Package Analysis project identified 'jest-cucumber-reporter' @ 0.0.9 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicio...

Malicious code in itfd (npm)

Source: ossf-package-analysis b402206ef266d63280b9361618b5ece377520d29080572d05c4a7dd0010f1e54 The OpenSSF Package Analysis project identified 'itfd' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The...

Malicious code in is24 (npm)

Source: ossf-package-analysis 1781ddf04bb479bb1a5178f987729c525417b1cc220c1be7fefbd9f86ccc7a23 The OpenSSF Package Analysis project identified 'is24' @ 9.9.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The...

Malicious code in irviewer (npm)

Source: ossf-package-analysis 2856bec7b72be87c4b6cc3f537871ee579bda13ad09ff85f5391ea1c0fdfe660 The OpenSSF Package Analysis project identified 'irviewer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...

Malicious code in invalid-polyfill-missing (npm)

Source: ossf-package-analysis 295b859cd3be40684c8d7ebb9bc2a3ca4bb969aad8ff1d524948397a3724c444 The OpenSSF Package Analysis project identified 'invalid-polyfill-missing' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...

Malicious code in internal-udfc-pkg (npm)

Source: ossf-package-analysis 25708e4f5f0536339a12c9bf28e659c821359f2733ff51d193cd6d74443c3650 The OpenSSF Package Analysis project identified 'internal-udfc-pkg' @ 5.5.5 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in internal-utils (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis c0d00b355d25f3b655de9e0b371123c75c0761a20b1bb05f7d45dcf595586070 The OpenSSF Package Analysis project identified 'internal-utils' @ 1.0.0 npm as malicious. It is considered malicious because: ...

Malicious code in intel-quantum-sdk (npm)

Source: ossf-package-analysis fa156b1cde9820ee0b03c5c4a594de333baa592c69177eb84a7c8ddf13963208 The OpenSSF Package Analysis project identified 'intel-quantum-sdk' @ 1.5.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in innotecsaludo (npm)

Source: ossf-package-analysis c0835a79941b28db8905c92debfa5937bc9bb5707163402d7b82630d5f35fd14 The OpenSSF Package Analysis project identified 'innotecsaludo' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in indoorviewer (npm)

Source: ossf-package-analysis d122f62071d7bd6fa6a2bf6fad646576aac0cb7826254901e07af309d40e2347 The OpenSSF Package Analysis project identified 'indoorviewer' @ 100.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in inditextech (npm)

Source: ossf-package-analysis 455c80b36b4b1ba97172a5cd0ebbe04c6b7fd35f405aeaa3d570ae77522dc433 The OpenSSF Package Analysis project identified 'inditextech' @ 10.0.3 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ...