waldiez-runner (0.5.9) potentially affected by CVE-2026-102937 via virtualenv (20.33.0)

virtualenv PYPI version 20.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - waldiez-runner 0.5.9 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...

waldiez-runner (0.5.9) potentially affected by CVE-2026-102938 via virtualenv (20.33.0)

virtualenv PYPI version 20.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - waldiez-runner 0.5.9 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102938 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102938 Source advisory:...

@aiconnect/codelets-runner (>=0.1.0, <=0.2.0), @cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4) +23 more potentially affected by CVE-2026-92954 via vm2 (>=3.10.0, <=3.11.6)

vm2 NPM version =3.10.0, =0.1.0, =1.0.0-beta.1, =3.0.46, =2.32.7, =2.32.0, =1.0.0, =1.1.15, =1.27.8, =1.0.0-beta.1, =2.32.0, =2.32.0, =2.40.2 and more Source cves: CVE-2026-92954 Source advisory: MEND:CVE-2026-92954...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

PT-2026-95095

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description The validation test harness allows the deserialization of tracked pickle cache files via the pickle.load method within the read pickle data function located in tests/pickle...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

CVE-2026-85706 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-pages, gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce...

GHSA-F47W-MRG9-G9P2 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-pages, gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce...

CVE-2026-85706 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-pages...

GHSA-F47W-MRG9-G9P2 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-pages...

CVE-2026-91836: Incomplete Comparison with Missing Factors

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

CVE-2026-58502: Improper Neutralization of Special Elements used in an OS Command

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-59960

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960

@argos-ci/core versions prior to 6.2.1 contain an OS Command Injection (CWE-78) in the gitFetch() and gitMergeBase() functions within packages/core/src/ci-environment/git.ts. When a project has hasRemoteContentAccess: false (the default without a Git provider integration), attacker-controlled bra...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

EUVD-2026-77641

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

CVE-2026-59960: Improper Neutralization of Special Elements used in an OS Command

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...