MAL-2026-2420 Malicious code in @_wnpm/wnpm-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9729c3c0a6c625f2d6cc79833205a4331647989fa84d85bdd158924af91020fd The package @wnpm/wnpm-cli was found to contain malicious code. Source: ossf-package-analysis...

PT-2026-29908

Impact This is a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan RAT. Users of @usebruno/cli who ran npm install between 00:21 UTC and 03:30 UTC on March 31, 2026 may have been...

PT-2026-29967

Name of the Vulnerable Software and Affected Versions @usebruno/cli versions installed between 00:21 UTC and 03:30 UTC on March 31, 2026 Description A supply chain attack involving compromised versions of the axios npm package introduced a hidden dependency deploying a cross-platform Remote Acces...

CVE-2026-34733

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

Summary The AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !phpsapiname === 'cli' never evaluates to true due to how PHP...

EUVD-2026-17652

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard...

CLEANSTART-2026-WZ18491 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-33186 applied in versions: 0.28.7-r1, 0.29.0-r0, 0.30.0-r0

Multiple security vulnerabilities affect the step-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JJ09127 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-33186 applied in versions: 0.28.7-r1, 0.29.0-r0, 0.30.0-r0

Multiple security vulnerabilities affect the step-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-29822

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.15 through 4.5.68 Description PraisonAI is a multi-agent teams system. The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.open process without validation, allowlist...

PT-2026-29664

Name of the Vulnerable Software and Affected Versions goshs versions 1.1.0 through 2.0.0-beta.2 Description goshs, a SimpleHTTPServer written in Go, has a flaw where the Share Token mechanism can be bypassed. This bypass allows unauthorized access to all goshs functionalities, including code...

GHSA-M8X7-R2RG-VH5G FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...

CVE-2026-34733

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

10xscale-agentflow-cli (>=0.3.0, <=0.3.1), 3m (>=0.1.0, <=0.1.3) +2849 more potentially affected by CVE-2026-3308 via pymupdf (>=1.16.2, <=1.28.2)

pymupdf PYPI version =1.16.2, =0.3.0, =0.1.0, =0.18.0, =0.1.1001, =0.1.0, =1.1.0, =0.0.4.80, =5.0.5 - aait-store-cut-part-001 0.0.1 - aait-store-cut-part-002 0.0.1 - aait-store-cut-part-003 0.0.1 - aait-store-cut-part-004 0.0.1 - aait-store-cut-part-005 0.0.1 - aait-store-cut-part-006 0.0.1 -...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: k9s, google-osconfig-agent, kyverno-fips, gomplate-fips, steampipe, grype-fips, argo-workflows, pulumi-language-java, gitlab-rails-ce, kubescape-server-fips, syft-fips, xeol-fips, zarf, xeol, gitaly-fips, gitsign, pulumi-kubernetes-operator, skaffold, jfrog-cli,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: k9s, google-osconfig-agent, kyverno-fips, gomplate-fips, steampipe, grype-fips, argo-workflows, pulumi-language-java, gitlab-rails-ce, kubescape-server-fips, syft-fips, xeol-fips, zarf, xeol, gitaly-fips, gitsign, pulumi-kubernetes-operator, skaffold, jfrog-cli,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: k9s, google-osconfig-agent, kyverno-fips, gomplate-fips, steampipe, grype-fips, argo-workflows, pulumi-language-java, gitlab-rails-ce, kubescape-server-fips, syft-fips, xeol-fips, zarf, xeol, gitaly-fips, gitsign, pulumi-kubernetes-operator, skaffold, jfrog-cli,...

CVE-2026-4926 vulnerabilities

Vulnerabilities for packages: kibana, saf, vitess, code-server, opensearch-dashboards-fips, wazuh-dashboard, tileserver-gl, gemini-cli, langfuse, langfuse-fips, tileserver-gl-fips, thingsboard, redisinsight, opensearch-dashboards...