4445 matches found
CVE-2026-35022
Anthropic Claude Code CLI and Claude Agent SDK are cited in multiple sources as vulnerable to an OS command injection in authentication helper execution. The underlying issue is that helper configuration values are executed with shell=true without input validation, allowing injection of shell met...
CVE-2026-35020 Anthropic Claude Code & Agent SDK OS Command Injection via TERMINAL Environment Variable
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in the command lookup helper and deep-link terminal launcher that allows local attackers to execute arbitrary commands by manipulating the TERMINAL environment variable. Attackers can inject shell...
CVE-2024-14032
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite...
CVE-2024-14032 Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite...
PT-2026-30708
Name of the Vulnerable Software and Affected Versions Anthropic Claude Code CLI and Claude Agent SDK affected versions not specified Description Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection issue in authentication helper execution. Helper configuration values are...
CVE-2024-14032: Missing Authorization
Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbitrary code as root by exploiting an unprotected XPC service. Attackers can invoke the installFromPath:toPath:withReply: method to overwrite...
GHSA-78H2-9FRX-2JM8 vulnerabilities
Vulnerabilities for packages: grpcurl, gogatekeeper, livekit-egress, step-fips, splunk-otel-collector-fips, elastic-agent-fips, cosign-fips, beats-fips, caddy, kubeflow-pipelines, flux-kustomize-controller, crossplane-provider-gcp-fips, vault-csi-provider-fips, fulcio, policy-controller,...
CVE-2026-34986 vulnerabilities
Vulnerabilities for packages: grpcurl, gogatekeeper, livekit-egress, step-fips, splunk-otel-collector-fips, elastic-agent-fips, cosign-fips, beats-fips, caddy, kubeflow-pipelines, flux-kustomize-controller, crossplane-provider-gcp-fips, vault-csi-provider-fips, fulcio, policy-controller,...
EUVD-2026-18766
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single server as the client was trying to mount the shares with wrong credentials. It turned out the client...
EUVD-2026-18714
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix Content-Length u32 truncation in siphelptcp siphelptcp parses the SIP Content-Length header with simplestrtoul, which returns unsigned long, but stores the result in unsigned int clen. On 64-bit...
UBUNTU-CVE-2026-23448
In the Linux kernel, the following vulnerability has been resolved: net: usb: cdcncm: add ndpoffset to NDP16 nframes bounds check cdcncmrxverifyndp16 validates that the NDP header and its DPE entries fit within the skb. The first check correctly accounts for ndpoffset: if ndpoffset + sizeofstruct...
CVE-2026-23458
The CVE-2026-23458 entry describes a Linux kernel netfilter use-after-free in ctnetlink_dump_exp_ct(). The code stores a conntrack pointer in cb->data for the netlink dump callback (ctnetlink_exp_ct_dump_table()) and drops the conntrack reference after netlink_dump_start(), so multi-round dump...
The vulnerability of the gbaudio_dapm_free_controls() function in the drivers/staging/greybus/audio_helper.c driver for Greybus devices in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the gbaudiodapmfreecontrols function in the drivers/staging/greybus/audiohelper.c driver for Greybus devices in the Linux operating system is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...
EUVD-2026-17488
MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollution vulnerability exists in the Utils.merge helper used internally by MikroORM when merging object structures. The function did not prevent...
📄 Forcepoint One Endpoint macOS 25.08.5008 DLP Bypass
Forcepoint One Endpoint DLP Endpoint for macOS version 25.08.5008 with DLP Policy Engine version 10.2.0.298 allows a local standard non-admin user to bypass DLP content inspection and policy enforcement by sending SIGSTOP to user-owned browser helper processes Websense Endpoint Helper,...
PT-2026-36442
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read issue exists in the netfilter ctnetlink component. The problem occurs when userspace suggests a helper for a new expectation that differs from the existing mast...
PT-2026-36444
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the netfilter nf conntrack helper component. The function nf conntrack helper unregister calls nf ct expect iterate destroy to remove expectations...
PT-2026-40505
Уязвимость функции nf conntrack helper unregister ядра операционных систем Linux связана с неполной очисткой временных или вспомогательных ресурсов. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...
