CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...

PT-2026-31058

Name of the Vulnerable Software and Affected Versions SWIG affected versions not specified Description SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. Recommendations At the moment, there...

@142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +236 more potentially affected by CVE-2026-39365 via vite (>=7.0.0, <=7.3.1)

vite NPM version =7.0.0, =0.0.1-alpha.19, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.0.0-beta.23, =2.1.2-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-39365 Source advisory: OSV:GHSA-4W7W-66W2-5VF9...

@142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +196 more potentially affected by CVE-2026-39364 via vite (>=7.1.0, <=7.3.1)

vite NPM version =7.1.0, =0.0.1-alpha.19, =1.89.2, =20.2.0-next.3, =20.2.0-next.3, =0.1.0, =0.79.1, =1.0.0-beta.23, =2.1.2-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-39364 Source advisory: SNYK:JS-VITE-15922245...

@ablehi/automation-app-build (>=0.1.0, <=0.3.6), @ablehi/automation-app-cli (>=0.1.0, <=0.3.5) +69 more potentially affected by CVE-2026-39364 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.0.0-experimental-1c4cca1-20260410-cca3318b, =0.0.0-experimental-196ba2e-20260326-ed190390, =0.1.0, =0.3.1 and more Source cves: CVE-2026-39364 Source advisory:...

@142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +196 more potentially affected by CVE-2026-39364 via vite (>=7.1.0, <=7.3.1)

vite NPM version =7.1.0, =0.0.1-alpha.19, =1.89.2, =20.2.0-next.3, =20.2.0-next.3, =0.1.0, =0.79.1, =1.0.0-beta.23, =2.1.2-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-39364 Source advisory: OSV:GHSA-V2WJ-Q39Q-566R...

@ablehi/automation-app-build (>=0.1.0, <=0.3.6), @ablehi/automation-app-cli (>=0.1.0, <=0.3.5) +69 more potentially affected by CVE-2026-39364 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.0.0-experimental-1c4cca1-20260410-cca3318b, =0.0.0-experimental-196ba2e-20260326-ed190390, =0.1.0, =0.3.1 and more Source cves: CVE-2026-39364 Source advisory:...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +204 more potentially affected by CVE-2026-39363 via vite (>=6.0.0, <=6.4.1)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =0.55.0, =0.21.2-4.1, =0.21.23 and more Source cves: CVE-2026-39363 Source advisory: SNYK:JS-VITE-15922242...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +204 more potentially affected by CVE-2026-39363 via vite (>=6.0.0, <=6.4.1)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =0.55.0, =0.21.2-4.1, =0.21.23 and more Source cves: CVE-2026-39363 Source advisory: OSV:GHSA-P9FF-H696-F583...

@142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +236 more potentially affected by CVE-2026-39363 via vite (>=7.0.0, <=7.3.1)

vite NPM version =7.0.0, =0.0.1-alpha.19, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.0.0-beta.23, =2.1.2-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-39363 Source advisory: OSV:GHSA-P9FF-H696-F583...

@ablehi/automation-app-build (>=0.1.0, <=0.3.6), @ablehi/automation-app-cli (>=0.1.0, <=0.3.5) +69 more potentially affected by CVE-2026-39363 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.0.0-experimental-1c4cca1-20260410-cca3318b, =0.0.0-experimental-196ba2e-20260326-ed190390, =0.1.0, =0.3.1 and more Source cves: CVE-2026-39363 Source advisory:...

@142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +236 more potentially affected by CVE-2026-39363 via vite (>=7.0.0, <=7.3.1)

vite NPM version =7.0.0, =0.0.1-alpha.19, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.0.0-beta.23, =2.1.2-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-39363 Source advisory: SNYK:JS-VITE-15922242...

@ablehi/automation-app-build (>=0.1.0, <=0.3.6), @ablehi/automation-app-cli (>=0.1.0, <=0.3.5) +69 more potentially affected by CVE-2026-39363 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.0.0-experimental-1c4cca1-20260410-cca3318b, =0.0.0-experimental-196ba2e-20260326-ed190390, =0.1.0, =0.3.1 and more Source cves: CVE-2026-39363 Source advisory:...

CVE-2026-35043 BentoML: command injection in cloud deployment setup script (deployment.py)

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates systempackages directly into a...

CVE-2026-32871

A flaw was found in FastMCP. An authenticated attacker can exploit a path traversal vulnerability in the buildurl method of the RequestDirector class. By manipulating path parameters in an OpenAPI operation, an attacker can use directory traversal sequences ../ to bypass the intended API prefix...

PT-2026-35023

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An information leak exists in the build report function within xfrm user. The struct xfrm user report contains a u8 proto field followed by a struct xfrm selector, resulting in three byt...

CVE-2019-25686 Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service

Core FTP 2.0 build 653 contains a denial of service vulnerability in the PBSZ command that allows unauthenticated attackers to crash the service by sending a malformed command with an oversized buffer. Attackers can send a PBSZ command with a payload exceeding 211 bytes to trigger an access...

[SECURITY] Fedora 43 Update: rust-sccache-0.14.0-2.fc43

Sccache is a ccache-like tool. It is used as a compiler wrapper and avoids compilation when possible. Sccache has the capability to utilize caching in remote storage environments, including various cloud storage options, or alternatively, in local storage...

PT-2026-30353

Name of the Vulnerable Software and Affected Versions Spy Emergency version 23.0.205 Description The SpyEmrgHealth and SpyEmrgSrv services contain an unquoted service path issue. This allows local attackers to escalate privileges by placing malicious executable files in the unquoted service path...

NETGATE Spy Emergency 代码问题漏洞

NETGATE Spy Emergency is a Trojan virus detection and removal software developed by the Slovakian company NETGATE. There is a code vulnerability in NETGATE Spy Emergency build 23.0.205. This vulnerability stems from the fact that the SpyEmrgHealth and SpyEmrgSrv services use service paths without...