CVE-2026-48790

Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...

CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

EUVD-2026-56787

Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...

CVE-2026-48790

CVE-2026-48790 (turso-cli) : Versions prior to 1.0.26 store the Turso platform JWT in settings.json with world-readable permissions (0o644) due to Viper’s default configPermissions, enabling any local user on the host to read the file and exfiltrate the JWT, which grants full Turso platform acces...

CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...

CVE-2026-48790 turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...

SonicWall Email Security Affected By Multiple Vulnerabilities

1 CVE-2026-66149 - Improper Control of Generation of Code 'Code Injection' Vulnerability via netmaskImproper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restrict...

OPENSUSE-SU-2026:11493-1 buildpacks-cli-0.40.9-1.1 on GA media

These are all security issues fixed in the buildpacks-cli-0.40.9-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-70908

Name of the Vulnerable Software and Affected Versions SonicWall Email Security affected versions not specified Description An authenticated attacker with access to the restricted CLI can perform a local privilege escalation by injecting arbitrary OS commands that execute with root privileges. Thi...

PT-2026-70907

Name of the Vulnerable Software and Affected Versions GMS Command-Line Interface CLI versions prior to 9.5.1 Build 9510.1044 Description An authenticated command injection issue exists in the GMS Virtual Appliance interface. This flaw allows a low-privileged local user to execute system commands...

PT-2026-76419

These are all security issues fixed in the buildpacks-cli-0.40.9-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor

goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...

CVE-2026-64654

A flaw was found in GitHub CLI gh. Multiple commands within the tool fail to neutralize terminal escape sequences when displaying externally controlled content. An attacker who can influence this content can embed malicious escape sequences. These sequences are then interpreted by a user's...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

GHSA-5P4M-2WFM-XMQJ vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, authentik-fips, langfuse, opensearch-dashboards, pulumi, sqlpad, prism, vitess, jitsucom-jitsu, gitlab-rails-ce-fips, wazuh-dashboard-fips, authentik, kibana, unleash, ts-patch, renovate, wazuh-dashboard, code-server, langfuse-fips,...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the gh auth status process. An attacker can obtain partial authentication token values by accessing terminal or CI output where the process was executed. This is only exploitable if ...

MAL-2026-13522 Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

OESA-2026-3269 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

Linux Distros Unpatched Vulnerability : CVE-2026-64655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the...

Linux Distros Unpatched Vulnerability : CVE-2026-64652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain...