@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44008 via vm2 (>=3.0.0, <=3.11.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, thingsboard, keycloak-config-cli, zipkin...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, thingsboard, keycloak-config-cli, zipkin...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: nacos-docker, kafbat-ui-fips, keycloak-config-cli, kafbat-ui, zipkin, conductor, thingsboard, camunda-zeebe, nacos, apache-nifi-registry, conductor-fips...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: nacos-docker, kafbat-ui-fips, keycloak-config-cli, kafbat-ui, zipkin, conductor, thingsboard, camunda-zeebe, nacos, apache-nifi-registry, conductor-fips...

CVE-2026-42150 wlc: print_html outputs API data without HTML escaping, enabling stored XSS

wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0...

GHSA-XHRW-5QXX-JPWR Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 27, 2026 to May 3, 2026)

Last week, there were 87 vulnerabilities disclosed in 198 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 61 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities ...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-43998 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@xapp/cli (1.8.11), stentor (>=1.68.30, <=1.72.1) +9 more potentially affected by CVE-2026-43999 via vm2 (3.10.5)

vm2 NPM version 3.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @xapp/cli 1.8.11 - stentor =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.72.1 Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44006 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

CVE-2026-42338 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, wazuh-dashboard, gemini-cli, kibana, lerna, graalvm, langfuse-fips, pulumi, renovate, tileserver-gl-fips, code-server, librechat, drupal, sqlpad, kubeflow-pipelines, tileserver-gl, opensearch-dashboards-fips, wazuh-dashboard-fips, prism,...

GHSA-PGF8-2HGJ-GRQG Vercel: Non-interactive mode includes CLI arguments in suggested command output

Summary When the Vercel CLI runs in non-interactive mode --non-interactive or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included...

NPM: Vercel: Non-interactive mode includes CLI arguments in suggested command output

NPM: Vercel: Non-interactive mode includes CLI arguments in suggested command output vulnerability discovered by ? in WordPress Npm vercel versions = 50.16.0, = 52.0.0...

PT-2026-38406

Name of the Vulnerable Software and Affected Versions Vercel CLI versions 50.16.0 through 52.0.0 Description When running in non-interactive mode via the --non-interactive flag or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads containing suggested follow-up...

cf-cli-8.18.3+git.0.83ce51d9c-1.1 on GA media (moderate)

cf-cli-8.18.3+git.0.83ce51d9c-1.1 on GA media Announcement ID: openSUSE-SU-2026:10688-1 Rating: moderate Cross-References: CVE-2025-61729 CVSS scores: CVE-2025-61729 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61729 SUSE : 8.7...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CLI Proxy API 代码问题漏洞

CLI Proxy API is an open-source CLI proxy server developed by Router-For.ME, which supports multi-model APIs. Version 6.9.29 of the CLI Proxy API has a code vulnerability that stems from the handling of the url parameter in the file internal/api/handlers/management/apitools.go. This vulnerability...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +64 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: SNYK:JS-NITRO-16757947...

ironhide (>=1.0.0, <=1.0.7), rorm-cli (0.5.0) +1 more potentially affected by unknown CVE via rpassword (>=7.0.0, <=7.2.0)

rpassword CARGO version =7.0.0, =1.0.0, =0.1.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-2P6R-X3VV-XQM2...