NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

CLSA-2026-1775694706 TuxCare security update for qs (6 CVEs)

TuxCare rebuilt qs to address 6 CVEs. Fixed in 0.5.1-tuxcare.1...

NPM: hashi-vault-js has a path traversal and query parameter injection

NPM: hashi-vault-js has a path traversal and query parameter injection vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summaryhyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is no...

CVE-2026-9085

CVE-2026-9085 affects Pardus-Parental-Control (=0.7.0) is published in the official advisories referenced, but the available documents do not confirm a remediation step.

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-memory condition in spdystream Go [CVE-2026-35469]

Summary IBM Watson Speech Services Cartridge is vulnerable to an out-of-memory condition in spdystream Go, caused by a flaw in SPDY/3 frame parser that does not validate attacker-controlled counts and lengths before allocating memory CVE-2026-35469. Spdystream Go is used in our speech utilities...

CVE-2026-42073

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter...

CVE-2026-42073

Summary: CVE-2026-42073 affects OpenClaude MCP OAuth callback flow. A logic flaw in the conditional order allows an attacker to bypass the CSRF state check when an error parameter is present, forcing the local OAuth callback server to shut down (DoS) without knowing the expected state. Affected c...

CVE-2026-42073 OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter...

EUVD-2026-33973

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter...

CVE-2026-42074

OpenClaude

CVE-2026-42074 OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM an untrusted principal per the project's own threat model can set ...

CVE-2026-42074 OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM an untrusted principal per the project's own threat model can set ...

OpenClaude 安全漏洞

OpenClaude is an open-source coding assistant CLI developed by Gitlawb, which supports multiple backends. Prior to version 0.5.1, OpenClaude had a security vulnerability. This vulnerability stemmed from the dangerouslyDisableSandbox parameter being exposed in the BashTool input mode, and the...

CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...

CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...

CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...