openSUSE 16 Security Update : gh (openSUSE-SU-2026:21432-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21432-1 advisory. Changes in gh: - CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version...

jo-cli (1.0.2) potentially affected by CVE-2026-14257 via brace-expansion (3.0.0)

brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-14257 Source advisory: OSV:GHSA-MH99-V99M-4GVG...

Weblate: SSRF via URL Parser Differential in `normalize_request_url` (wlc)

The Weblate CLI client wlc was found to be vulnerable to Server-Side Request Forgery SSRF due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalizerequesturl function, which was meant to validate that outgoing API requests stayed...

@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +11 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)

@fastify/static NPM version =10.1.0, =0.0.4, =3.1.17, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =9.0.0-canary.19, =9.0.2 Source cves: CVE-2026-7120 Source advisory: OSV:GHSA-8PVW-JCV7-9CMJ...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0259-1 Rating: important References: 1266618 Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE: 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE...

PYSEC-2026-3515 PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default

Summary The published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint: text praisonai serve...

CVE-2026-16629 danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, vault-secrets-operator-fips, scorecard, crossplane-provider-aws-quicksight-fips, crossplane-provider-aws-athena-fips, crossplane-provider-aws-kinesisvideo-fips, beats, mapotf, wavefront-collector-for-kubernetes,...

CVE-2026-56852 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, vault-secrets-operator-fips, scorecard, crossplane-provider-aws-quicksight-fips, crossplane-provider-aws-athena-fips, crossplane-provider-aws-kinesisvideo-fips, beats, mapotf, wavefront-collector-for-kubernetes,...

OPENSUSE-SU-2026:21406-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate bsc1270542. - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl cra...

PT-2026-64055

These are all security issues fixed in the gh-2.96.0-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-63511

Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8 Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File...

@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +6 more potentially affected by CVE-2026-73651 via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =1.6.5, =2.1.5, =0.2.0, =1.1.43, =1.1.45 Source cves: CVE-2026-73651 Source advisory:...

EUVD-2026-46418

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

AZL-93162 CVE-2026-56852 affecting package dcos-cli for versions less than 1.2.0-22

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-93168 CVE-2026-56852 affecting package docker-cli for versions less than 25.0.7-4

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-93183 CVE-2026-56852 affecting package gh for versions less than 2.62.0-20

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-93144 CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

@sigstore/cli (>=0.7.0, <=0.9.1) potentially affected by CVE-2026-59891 via @sigstore/oci (>=0.2.0, <=0.6.1)

@sigstore/oci NPM version =0.2.0, =0.7.0, =0.9.1 Source cves: CVE-2026-59891 Source advisory: OSV:GHSA-PF56-329R-95RW...

CVE-2026-47395 PraisonAI CLI automatically resolves @url mentions in prompt text and can read loopback URLs into model context

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...