aiowhitebit-mcp (>=0.2.2, <=0.2.4), antdigital-aico-guard-mcp-server (>=0.1.0, <=0.1.3) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.2.5)

fastmcp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aiowhitebit-mcp =0.2.2, =0.1.0, =0.2.1, =3.2.2 - spoon-ai-sdk 0.1.3 - spoon-toolkits 0.1.3 Source cves: CVE-2026-32871 Source advisory:...

aiowhitebit-mcp (>=0.2.2, <=0.2.4), antdigital-aico-guard-mcp-server (>=0.1.0, <=0.1.3) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.2.5)

fastmcp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aiowhitebit-mcp =0.2.2, =0.1.0, =0.2.1, =3.2.2 - spoon-ai-sdk 0.1.3 - spoon-toolkits 0.1.3 Source cves: CVE-2026-27124 Source advisory:...

CVE-2026-34041

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an...

CVE-2026-34042

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

act-workflow (>=4.8.2, <=4.8.399) potentially affected by CVE-2026-34070 via langchain-core (0.3.11)

langchain-core PYPI version 0.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - act-workflow =4.8.2, =4.8.399 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

CVE-2026-34042 act: actions/cache server allows malicious cache injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

CVE-2026-34042

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

CVE-2026-34042 act: actions/cache server allows malicious cache injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

CVE-2026-34042 act: actions/cache server allows malicious cache injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

CVE-2026-34041 act: Unrestricted set-env and add-path command processing enables environment injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an...

CVE-2026-34041

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an...

CVE-2026-34041 act: Unrestricted set-env and add-path command processing enables environment injection

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an...

Act injection vulnerabilities

Act is a locally run tool developed by Nektos and open source. Versions of Act prior to 0.2.86 had an injection vulnerability. This vulnerability stemmed from unconditionally processing the::set-env:: and::add-path:: workflow commands, which could lead to setting arbitrary environment variables o...

CVE-2026-34042: Missing Authorization

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

Act security vulnerabilities

Act is a locally run tool developed by Nektos and open source. Versions of Act prior to 0.2.86 have security vulnerabilities. These vulnerabilities stem from the built-in actions/cache server, which listens to all interface connections. This could lead to arbitrary cache creation and retrieval,...

CVE-2026-34041: Improper Neutralization of Special Elements in Output Used by a Downstream Component

act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which was disabled due to environment injection risks. When a workflow step echoes untrusted data to stdout, an...

CVE-2026-4724

creationtimestamp| type| source ---|---|--- 2026-03-29 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/...

CVE-2026-33896

Technical details are not publicly available in the provided documents; no affected products, versions, or remediation are specified. Monitor for updates to confirm scope and fixes.

CVE-2026-33896 Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, pki.verifyCertificateChain does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions...

act-workflow (>=4.8.2, <=4.8.399) potentially affected by CVE-2026-34070 via langchain-core (0.3.11)

langchain-core PYPI version 0.3.11 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - act-workflow =4.8.2, =4.8.399 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...