Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale System and the Management GUI are now fixed in 6.2.3.6 or higher and 7.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale System and the Management GUI and could provide weaker-than-expected security, are now fixed in Storage Scale 6.2.3.6 or higher and 7.0.1.1 or higher. Vulnerability Details CVEID:CVE-2026-13460 DESCRIPTION: IBM Storage Scal...

CVE-2026-109358

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable 0666. Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate...

Malware in node-telegram-sockets

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in node-telegram-sockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222b22669330f75e779595b40bac9e2a842ef38fad691aaa46a0f4a615a55fc1 Package presents as a Telegram bot API client library node-telegram-bot-api family. a static rule fired on keyword co-occurrence in lib/telegram.js a...

MAL-2026-17845 Malicious code in node-telegram-sockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222b22669330f75e779595b40bac9e2a842ef38fad691aaa46a0f4a615a55fc1 Package presents as a Telegram bot API client library node-telegram-bot-api family. a static rule fired on keyword co-occurrence in lib/telegram.js a...

CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable 0666. Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate...

EUVD-2026-97660

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable 0666. Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate...

CVE-2026-109358

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable 0666. Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate...

MAL-2026-17837 Malicious code in @sanzoffc/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2838d53888242c50e19ce80fc949f25a34de59a1282fc3631abf64a671e7afe9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@sanz-0fx/baileys-mod (1.0.3-beta), @sanzsayangvien/baileys-pro (2.0.4) +1 more potentially affected by unknown CVE via @sanzoffc/libsignal-node (0.0.1-security)

@sanzoffc/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @sanzoffc/libsignal-node and may be impacted: - @sanz-0fx/baileys-mod 1.0.3-beta - @sanzsayangvien/baileys-pro 2.0.4 - @sanzstore/baileys-pro =1.0.0,...

@sanz-0fx/baileys-mod (1.0.3-beta), @sanzsayangvien/baileys-pro (2.0.4) +1 more potentially affected by unknown CVE via @sanzoffc/libsignal-node (0.0.1-security)

@sanzoffc/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @sanzoffc/libsignal-node and may be impacted: - @sanz-0fx/baileys-mod 1.0.3-beta - @sanzsayangvien/baileys-pro 2.0.4 - @sanzstore/baileys-pro =1.0.0,...

Malware in @sanzoffc/libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @sanzoffc/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2838d53888242c50e19ce80fc949f25a34de59a1282fc3631abf64a671e7afe9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17836 Malicious code in @saazkira/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02ddff50116449dec10c106e58ae0c84f16919145b8e13ddea1a23b0f00e9c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @saazkira/libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @saazkira/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02ddff50116449dec10c106e58ae0c84f16919145b8e13ddea1a23b0f00e9c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @alipclutch/libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17818 Malicious code in @alipclutch/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

baileyscrew (1.4.1), bintzge-baileys (>=2.0.2, <=2.0.3) +5 more potentially affected by unknown CVE via @alipclutch/libsignal-node (0.0.1-security)

@alipclutch/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @alipclutch/libsignal-node and may be impacted: - baileyscrew 1.4.1 - bintzge-baileys =2.0.2, =28.0.0, =1.0.0, =1.0.2, =8.6.46, =8.6.52 Source cves:...

baileyscrew (1.4.1), bintzge-baileys (>=2.0.2, <=2.0.3) +5 more potentially affected by unknown CVE via @alipclutch/libsignal-node (0.0.1-security)

@alipclutch/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @alipclutch/libsignal-node and may be impacted: - baileyscrew 1.4.1 - bintzge-baileys =2.0.2, =28.0.0, =1.0.0, =1.0.2, =8.6.46, =8.6.52 Source cves:...