GHSA-QMCQ-XW74-W667 uniget CLI has an EDITOR Command Injection

Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...

PT-2026-76893

Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...

EUVD-2026-59799

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

CVE-2026-73047 siyuan before v3.7.4 Server-Side Template Injection via attribute-view

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

MAL-2026-14020 Malicious code in alelo-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e520850363c3164a09e0772022283849a0abd1b6f60e9168f4a5fd3ff338886 The package fires attacker-controlled code on npm install via both preinstall.js and index.js postinstall. preinstall.js collects hostname, username,...

MAL-2026-14028 Malicious code in alelo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1fd03e0ca4d5452b6a5d6aa2880a9c711021e287eaae056e68f70f6aedc926 On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to...

Malicious code in alelo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1fd03e0ca4d5452b6a5d6aa2880a9c711021e287eaae056e68f70f6aedc926 On npm install, preinstall.js collects hostname, username, platform, cwd and the full process.env and POSTs the JSON body to...

MAL-2026-14025 Malicious code in alelo-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5aceecfb22fd66b4e0861399aa6864ba19a983f3483294dd0740e7e24d1c34 On npm install, preinstall.js collects hostname, username, platform, cwd, and the full process.env and POSTs the payload over HTTPS with TLS...

MAL-2026-14033 Malicious code in meualelo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fdf84c3f49f6d13b7ccbed745056f8bf03c4c7a2b814152962361ac07bd4191 The package's preinstall.js collects hostname, username, platform, cwd, and the full process.env, then POSTs the JSON payload over HTTPS with TLS...

MAL-2026-14092 Malicious code in rimo-env-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56f06dbeb4a580e0e33781dc75aeea4c844f8de804be52f0a43097d85739c53c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rimo-env-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56f06dbeb4a580e0e33781dc75aeea4c844f8de804be52f0a43097d85739c53c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, gitness, docker-credential-acr-env, dgraph...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: dgraph, docker-credential-acr-env, gitness...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: argo-cd, k8s-device-plugin, gitlab-kas, azure-service-operator, spegel, snyk-cli, cadvisor, spiffe-helper, newrelic-fluent-bit-output, crossplane-provider-aws-kinesis, nginx-prometheus-exporter, tempo, secrets-store-csi-driver-provider-azure, sftpgo-plugin-eventstore...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: kapp, whereabouts, mockery, stern, spiffe-helper, cadvisor, azure-workload-identity-webhook, ipfs-cluster, checksec, oras, ghaudit, mongo-tools, pguser, direnv, helm-set-status, kubernetes-dashboard-metrics-scraper, terraform-provider-azuread, slsa-verifier, nats,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: kapp, whereabouts, mockery, stern, spiffe-helper, cadvisor, azure-workload-identity-webhook, ipfs-cluster, checksec, oras, ghaudit, mongo-tools, pguser, direnv, helm-set-status, kubernetes-dashboard-metrics-scraper, terraform-provider-azuread, slsa-verifier, nats,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: cilium-cli, cadvisor, secrets-store-csi-driver-provider-azure, temporal-server, mongo-tools, slsa-verifier, nats, kubeflow-pipelines, gobuster, kube-fluentd-operator, amass, k3d, sops, terraform, crossplane-provider-aws, memcached-exporter, terraform-provider-sendgri...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: argo-cd, snyk-cli, azure-workload-identity-webhook, crossplane-provider-aws-kinesis, omnibump, sftpgo-plugin-eventstore, temporal-server, azcopy, kubernetes-csi-node-driver-registrar, aws-efs-csi-driver, coredns, slsa-verifier, harbor-scanner-trivy, authservice,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: azure-service-operator, crossplane-provider-aws-kinesis, tempo, azcopy, helm-set-status, crossplane, crossplane-provider-aws-route53, victoriametrics-operator, falco-exporter, weaviate, smarter-device-manager, syft, gh, keda, consul-k8s, jaeger, argocd-image-updater,...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: mockery, cilium-cli, spegel, snyk-cli, cadvisor, stern, newrelic-fluent-bit-output, secrets-store-csi-driver-provider-azure, oras, ghaudit, mongo-tools, aws-efs-csi-driver, direnv, kubernetes-dashboard-metrics-scraper, harbor-scanner-trivy, flyte, k3d, spqr,...