161 matches found
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
Overview A critical Arbitrary Code Execution ACE vulnerability exists in the Knowns Language Server Protocol LSP detection and startup pipeline. The system blindly trusts the settings.lsp.languages..binary field defined in the project-level .knowns/config.json file. Because this field is never...
CVE-2026-86472 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, vitess, prism...
GHSA-HRR3-GC8F-F4QJ vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, vitess, prism...
[SECURITY] Fedora 43 Update: ty-0.0.84-1.fc43
An extremely fast Python type checker and language server, written in Rust...
GHSA-58MR-GQGX-XQ4G vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, serve, wazuh-dashboard, wazuh-dashboard-fips, keep-fips, prism, yaml-language-server, renovate, keep, nextcloud-server, vitess, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, opensearch-dashboards, unleash-proxy, commercial-gitlab-rails-ee,...
CVE-2026-84292 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, serve, wazuh-dashboard, wazuh-dashboard-fips, keep-fips, prism, jupyter-base-notebook, yaml-language-server, renovate, keep, nextcloud-server, vitess, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, opensearch-dashboards, unleash-proxy,...
CVE-2026-84394 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, serve, wazuh-dashboard, wazuh-dashboard-fips, keep-fips, prism, yaml-language-server, renovate, keep, nextcloud-server, vitess, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, opensearch-dashboards, unleash-proxy, commercial-gitlab-rails-ee,...
GHSA-QW65-CVWX-89V3 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, serve, wazuh-dashboard, wazuh-dashboard-fips, keep-fips, prism, jupyter-base-notebook, yaml-language-server, renovate, keep, nextcloud-server, vitess, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips, opensearch-dashboards, unleash-proxy,...
CVE-2026-84394 vulnerabilities
Vulnerabilities for packages: yaml-language-server, serve, prism, opensearch-dashboards, vitess, renovate...
GHSA-58MR-GQGX-XQ4G vulnerabilities
Vulnerabilities for packages: yaml-language-server, serve, prism, opensearch-dashboards, vitess, renovate...
GHSA-QW65-CVWX-89V3 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, serve, prism, opensearch-dashboards, vitess, renovate...
CVE-2026-84292 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, serve, prism, opensearch-dashboards, vitess, renovate...
CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binar...
Malicious Package
Overview dbt-language-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-48122
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...
CVE-2026-48122 Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...
CVE-2026-18446 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, saf, nextcloud-server, langfuse-fips, librechat, serve, arangodb, argo-workflows, opensearch-dashboards-fips, langfuse, renovate, vitess, gitlab-rails-ce-fips, opensearch-dashboards, commercial-gitlab-rails-ee, gemini-cli,...
GHSA-7P8R-X3MC-P8W7 vulnerabilities
Vulnerabilities for packages: jupyter-base-notebook, yaml-language-server, saf, nextcloud-server, langfuse-fips, librechat, serve, arangodb, argo-workflows, opensearch-dashboards-fips, langfuse, renovate, vitess, gitlab-rails-ce-fips, opensearch-dashboards, commercial-gitlab-rails-ee, gemini-cli,...