9036 matches found
CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it...
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Summary The Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI...
CVE-2026-33748 vulnerabilities
Vulnerabilities for packages: trivy-operator, scorecard, skaffold, trivy, guac, osv-scanner, docker-compose, kaniko, kubescape, docker-cli-buildx, buildah, podman, conftest, zot...
GHSA-4C29-8RGM-JVJJ vulnerabilities
Vulnerabilities for packages: trivy-operator, scorecard, skaffold, trivy, guac, osv-scanner, docker-compose, kaniko, kubescape, docker-cli-buildx, buildah, podman, conftest, zot...
GHSA-4VRQ-3VRQ-G6GG vulnerabilities
Vulnerabilities for packages: trivy-operator, scorecard, skaffold, trivy, guac, osv-scanner, docker-compose, kaniko, kubescape, docker-cli-buildx, buildah, podman, conftest, zot...
CVE-2026-33747 vulnerabilities
Vulnerabilities for packages: trivy-operator, scorecard, skaffold, trivy, guac, osv-scanner, docker-compose, kaniko, kubescape, docker-cli-buildx, buildah, podman, conftest, zot...
GHSA-4VRQ-3VRQ-G6GG vulnerabilities
Vulnerabilities for packages: kaniko, docker-cli-buildx-fips, docker-compose, docker-fips, zot, conftest, kubescape-server, livekit-cli, skaffold, podman, trivy-operator-fips, cloudbeat-fips, osv-scanner, kaniko-fips, trivy-operator, trivy, guac, docker-cli-buildx, buildah-fips, buildah, cloudbea...
CVE-2026-33747 vulnerabilities
Vulnerabilities for packages: kaniko, docker-cli-buildx-fips, docker-compose, docker-fips, zot, conftest, kubescape-server, livekit-cli, skaffold, podman, trivy-operator-fips, cloudbeat-fips, osv-scanner, kaniko-fips, trivy-operator, trivy, guac, docker-cli-buildx, buildah-fips, buildah, cloudbea...
CVE-2026-33748 vulnerabilities
Vulnerabilities for packages: kaniko, docker-cli-buildx-fips, docker-compose, docker-fips, zot, conftest, kubescape-server, livekit-cli, skaffold, podman, trivy-operator-fips, cloudbeat-fips, osv-scanner, kaniko-fips, trivy-operator, trivy, guac, docker-cli-buildx, buildah-fips, buildah, cloudbea...
PT-2026-28312
Name of the Vulnerable Software and Affected Versions Coverity Connect affected versions not specified Description The authentication logic in the command line tooling for Coverity Connect is missing an error handler, leading to a potential authentication bypass. An attacker with access to the...
External Control of Critical State Data
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of Critical State Data in the CLI routing process after failed service resolution, where Bonjour and DNS-SD TXT metadata could still influence the chosen target. An...
GHSA-RVQR-HRCC-J9VV OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
Summary Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
Summary Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...
CVE-2021-4474 Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access
Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows authenticated remote attackers with administrative privileges to read arbitrary files from the underlying filesystem. Attackers can exploit this vulnerability to access sensitive...
@antora/cli (>=2.3.2, <=3.0.0-alpha.9), @antora/playbook-builder (>=2.3.2, <=3.0.0-alpha.9) +111 more potentially affected by CVE-2026-33864 via convict (>=6.0.0, <=6.2.4)
convict NPM version =6.0.0, =2.3.2, =2.3.2, =2.3.2, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-33864 Source advisory: OSV:GHSA-44FC-8FM5-Q62H...
jo-cli (1.0.2) potentially affected by CVE-2026-33750 via brace-expansion (3.0.0)
brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-33750 Source advisory: OSV:GHSA-F886-M6HF-6M8V...
jo-cli (1.0.2) potentially affected by CVE-2026-33750 via brace-expansion (3.0.0)
brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-33750 Source advisory: SNYK:JS-BRACEEXPANSION-15789759...
CVE-2025-15518
Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the...
CVE-2025-15519
Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the...