CVE-2026-48501

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

DEBIAN-CVE-2026-48501

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

EUVD-2026-33340

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

A Protocol-Language Model for Network Intrusion (Without Deep Packet Inspection)

Modern network intrusion detection systems NIDS are caught in a structural contradiction: the protocols carrying the highest threat intelligence are precisely those encrypted under TLS 1.3 and QUIC, where payload inspection yields nothing. We ask a simpler question -- what if the attack signature...

The vulnerability of the config.xml configuration file of the Notepad++ text editor allows a hacker to execute arbitrary code.

The vulnerability of the config.xml configuration file of the text editor Notepad++ is related to the lack of measures taken to eliminate special elements during the processing of the commandLineInterpreter parameter. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-49130

MPD (Music Player Daemon) prior to version 0.24.11 is affected by a CRLF injection vulnerability in the XSPF playlist plugin’s xspf_char_data function. By supplying a malicious XSPF playlist that exploits XML numeric character references, an attacker can cause Expat decoding to insert literal CR/...

EUVD-2026-32664

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...

CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...

GHSA-XX3C-QF5G-HC39 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Description Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration e.g. smtp://..., sendmail://..., native://default. SendmailTransport invokes the local sendmail binary and supports two modes: -bs speak SMTP over stdin: the default and -t read the message on...

GHSA-QPMX-3RFJ-7RHV Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

CVE-2026-45088

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...

CVE-2026-44345

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...

CVE-2026-39834 vulnerabilities

Vulnerabilities for packages: chisel, external-dns, gptscript, podman, cosign, crossplane-provider-aws-sns, traefik, argo-cd, docker-machine-driver-linode, policy-controller, crossplane-provider-aws-iam, rootlesskit, docker, flux-kustomize-controller, kaf, wolfictl, k9s, step-kms-plugin, flux,...

CVE-2026-46598 vulnerabilities

Vulnerabilities for packages: external-dns, rancher-agent, podman, external-secrets-operator, docker-cli-buildx, minio, containerd, cilium, kaf, telegraf, kyverno, istio, cilium-cli, mattermost, cloud-provider-aws, opentelemetry-collector, snyk-cli, falco-no-driver, flux, zot, aactl, kubernetes,...

CVE-2026-39828 vulnerabilities

Vulnerabilities for packages: chisel, external-dns, rancher-agent, flux-image-automation-controller, zarf, external-secrets-operator, kubescape, minio, containerd, trivy, trivy-operator, cilium, flux-source-controller, kaf, telegraf, kyverno, istio, k9s, cilium-cli, mattermost, cloud-provider-aws...

WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Line Agency versions = 1.3.1...

CVE-2026-39832 vulnerabilities

Vulnerabilities for packages: containerd, falco-no-driver, kine, trufflehog-fips, jfrog-cli, nemo, argo-events, buildah-fips, teleport-operator-fips, podman, gitlab-workhorse-ce-fips, apply-cve-bump, cloud-provider-aws, pulumi-language-java, pulumi-language-yaml, minio, grype, tekton-pipelines, c...

CVE-2026-46595 vulnerabilities

Vulnerabilities for packages: containerd, falco-no-driver, kine, nemo, gitlab-workhorse-ce-fips, cloud-provider-aws, minio, tekton-pipelines, gitlab-workhorse-ce, kubescape, kubernetes-dashboard, upwind-agent, external-dns, frankenphp-8.3, k9s-fips, gitea-fips, fscrypt, gatekeeper, calico-fips,...