--- title: "Security digest: February 25, 2026" url: https://erroneo.us/security/2026-02-25/ description: "February 25, 2026 vulnerability digest: 1 brief (Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED…); 2 CISA KEV additions (Cisco); 18 critical advisories…" type: security-digest-day section: "Security Digest" date_published: 2026-02-25 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: February 25, 2026 1 editorial brief, 2 known exploited (cisa kev) additions and 18 critical advisories. ## Take stock - Act now: Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03 . Owners of on-prem or Cisco-hosted Catalyst SD-WAN Controller, Manager or Validator deployments, especially with ports 22/830 or the web UI reachable from untrusted networks. - Do you run any of these? Cisco Catalyst SD-WAN Controller and Manager, Cisco SD-WAN. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-02-27. - npm: 13 critical advisories ( n8n , @angular/ssr , @nguniversal/common , @nguniversal/express-engine , budibase , parse-dashboard , @oneuptime/common , @enclave-vm/core …). Check with npm audit (or: npm ls ) . - PyPI: 2 critical advisories ( bugsink , flask-reuploaded ). Check with pip-audit (or: pip show ) . - Go: 2 critical advisories ( github.com/OliveTin/OliveTin , code.vikunja.io/api ). Check with govulncheck ./... . - crates.io (Rust): 1 critical advisory ( rustfs ). Check with cargo audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [Cisco SD-WAN CVE-2026-20127: CVSS 10 Bypass, ED 26-03](https://erroneo.us/security/briefs/cisco-catalyst-sd-wan-cve-2026-20127-auth-bypass/index.md): If you run on-prem Catalyst SD-WAN control components, upgrade and hunt now: a sophisticated actor has used this bypass for years, and the follow-on SD-WAN bugs CISA keeps adding to KEV show the platform is still being targeted. ## Known exploited (CISA KEV) - [CVE-2026-20127](https://erroneo.us/security/cve/CVE-2026-20127/index.md) Cisco Catalyst SD-WAN Controller and Manager: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability (CISA due 2026-02-27) - [CVE-2022-20775](https://erroneo.us/security/cve/CVE-2022-20775/index.md) Cisco SD-WAN: Cisco SD-WAN Path Traversal Vulnerability (CISA due 2026-02-27) ## Critical advisories - [CVE-2026-27498](https://erroneo.us/security/cve/CVE-2026-27498/index.md) n8n has Arbitrary Command Execution via File Write and Git Operations — npm n8n < 1.123.8 → 1.123.8; npm n8n >= 2.0.0, < 2.2.0 → 2.2.0 - [CVE-2026-27739](https://erroneo.us/security/cve/CVE-2026-27739/index.md) Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline — npm @angular/ssr >= 21.2.0-next.0, < 21.2.0-rc.0 → 21.2.0-rc.1; npm @angular/ssr >= 21.0.0-next.0, < 21.1.5 → 21.1.5; npm @angular/ssr >= 20.0.0-next.0, < 20.3.17 → 20.3.17 - [CVE-2026-27497](https://erroneo.us/security/cve/CVE-2026-27497/index.md) n8n has Potential Remote Code Execution via Merge Node — npm n8n < 1.123.22 → 1.123.22; npm n8n >= 2.0.0, < 2.9.3 → 2.9.3; npm n8n >= 2.10.0, < 2.10.1 → 2.10.1 - [CVE-2026-27577](https://erroneo.us/security/cve/CVE-2026-27577/index.md) n8n: Expression Sandbox Escape Leads to RCE — npm n8n < 1.123.22 → 1.123.22; npm n8n >= 2.0.0, < 2.9.3 → 2.9.3; npm n8n >= 2.10.0, < 2.10.1 → 2.10.1 - [CVE-2026-27614](https://erroneo.us/security/cve/CVE-2026-27614/index.md) Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering — PyPI bugsink <= 2.0.12 → 2.0.13 - [CVE-2026-27822](https://erroneo.us/security/cve/CVE-2026-27822/index.md) Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover — crates.io (Rust) rustfs < 1.0.0-alpha.83 → 1.0.0-alpha.83 - [CVE-2026-27702](https://erroneo.us/security/cve/CVE-2026-27702/index.md) Budibase: Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) — npm budibase < 3.30.4 → 3.30.4 - [CVE-2026-27595](https://erroneo.us/security/cve/CVE-2026-27595/index.md) Parse Dashboard has incomplete authentication on AI Agent endpoint — npm parse-dashboard >= 7.3.0-alpha.42, < 9.0.0-alpha.8 → 9.0.0-alpha.8 - [CVE-2026-27728](https://erroneo.us/security/cve/CVE-2026-27728/index.md) OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() — npm @oneuptime/common < 10.0.7 → 10.0.7 - [CVE-2026-27495](https://erroneo.us/security/cve/CVE-2026-27495/index.md) n8n has a Sandbox Escape in its JavaScript Task Runner — npm n8n < 1.123.22 → 1.123.22; npm n8n >= 2.0.0, < 2.9.3 → 2.9.3; npm n8n >= 2.10.0, < 2.10.1 → 2.10.1 - [CVE-2026-27597](https://erroneo.us/security/cve/CVE-2026-27597/index.md) @enclave-vm/core is vulnerable to Sandbox Escape — npm @enclave-vm/core <= 2.10.1 → 2.11.1 - [CVE-2026-27608](https://erroneo.us/security/cve/CVE-2026-27608/index.md) Parse Dashboard is Missing Authorization for its Agent Endpoint — npm parse-dashboard >= 7.3.0-alpha.42, <= 9.0.0-alpha.7 → 9.0.0-alpha.8 - [CVE-2026-27493](https://erroneo.us/security/cve/CVE-2026-27493/index.md) n8n has Unauthenticated Expression Evaluation via Form Node — npm n8n < 1.123.22 → 1.123.22; npm n8n >= 2.0.0, < 2.9.3 → 2.9.3; npm n8n >= 2.10.0, < 2.10.1 → 2.10.1 - [CVE-2026-27641](https://erroneo.us/security/cve/CVE-2026-27641/index.md) Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection — PyPI flask-reuploaded < 1.5.0 → 1.5.0 - [CVE-2026-27699](https://erroneo.us/security/cve/CVE-2026-27699/index.md) Basic FTP has Path Traversal Vulnerability in its downloadToDir() method — npm basic-ftp < 5.2.0 → 5.2.0 - [CVE-2026-27804](https://erroneo.us/security/cve/CVE-2026-27804/index.md) Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter — npm parse-server >= 9.0.0, <= 9.3.1-alpha.3 → 9.3.1-alpha.4; npm parse-server <= 8.6.2 → 8.6.3 - [CVE-2026-27626](https://erroneo.us/security/cve/CVE-2026-27626/index.md) OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks — Go github.com/OliveTin/OliveTin < 0.0.0-20260222101908-4bbd2eab1532 → 0.0.0-20260222101908-4bbd2eab1532 - [CVE-2026-27575](https://erroneo.us/security/cve/CVE-2026-27575/index.md) Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change — Go code.vikunja.io/api <= 0.24.6 → no fix --- Source page: https://erroneo.us/security/2026-02-25/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt