MAL-2026-2764 Malicious code in gemini-cli-vscode-ide-companion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a98d87fa5f23a47c4b1ea2c0cecb3e88518985493c1b7f125299ecf8ee6dba1 The package gemini-cli-vscode-ide-companion was found to contain malicious code...

MAL-2026-2763 Malicious code in gemini-ai-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce523af945a4246ec60ceb49c42757844915ea6b3657e989e0254ae1212aab92 The package gemini-ai-checker was found to contain malicious code...

Malicious code in gemini-ai-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce523af945a4246ec60ceb49c42757844915ea6b3657e989e0254ae1212aab92 The package gemini-ai-checker was found to contain malicious code...

Maestro 0.15.3

Maestro is a cross-platform desktop app for orchestrating your fleet of AI agents and projects. It's a high-velocity solution for hackers who are juggling multiple projects in parallel. Designed for power users who live on the keyboard and rarely touch the mouse. Collaborate with AI to create...

GHSA-R5RP-J6WH-RVV4 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

GHSA-WMMM-F939-6G9C vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

GHSA-XPCF-PG52-R92G vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

CVE-2026-39406 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, wazuh-dashboard-fips, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, wazuh-dashboard, langfuse...

CVE-2026-39407 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

CVE-2026-39408 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

CVE-2026-39409 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

GHSA-26PP-8WGV-HJVM vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

GHSA-92PP-H63X-V22M vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, wazuh-dashboard-fips, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, wazuh-dashboard, langfuse...

CVE-2026-39410 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

GHSA-XF4J-XP2R-RQQX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, librechat, opensearch-dashboards-fips, langfuse-fips, gemini-cli, kibana, langfuse...

Vulnerability Detection with Interprocedural Context in Multiple Languages: Assessing Effectiveness and Cost of Modern LLMs

Large Language Models LLMs have been a promising way for automated vulnerability detection. However, most prior studies have explored the use of LLMs to detect vulnerabilities only within single functions, disregarding those related to interprocedural dependencies. These studies overlook...

CVE-2025-64340

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run wit...

OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

Summary Before OpenClaw 2026.4.2, the Gemini OAuth flow reused the PKCE verifier as the OAuth state value. Because the provider reflected state back in the redirect URL, the verifier could be exposed alongside the authorization code. Impact Anyone who could capture the redirect URL could learn bo...

EUVD-2026-18849

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption...

Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jpj-g8vv-j5mf. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it...