CVE-2026-19591

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

CVE-2026-19591

The OpenAI Codex CLI (Windows, macOS, Linux) and Codex Desktop (Windows, macOS) are vulnerable to Remote Code Execution (RCE) due to the improper neutralization of control sequences. A discrepancy exists where the command-safety parser incorrectly interprets PowerShell's stop-parsing token (--%) ...

@bendyline/docblocks-cli (>=2.4.0, <=2.5.0), @bendyline/docblocks-react (>=2.4.0, <=2.5.0) +14 more potentially affected by CVE-2026-83617 via @xmldom/xmldom (0.9.11)

@xmldom/xmldom NPM version 0.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on @xmldom/xmldom and may be impacted: - @bendyline/docblocks-cli =2.4.0, =2.4.0, =1.0.4, =1.0.4, =2.5.5, =2.7.3, =2.4.4, =1.0.2, =0.9.1, =0.9.1, =0.4.1, =0.0.14, =0.0.45 an...

Malicious code in gcphelpit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d The module src/gcphelpit/verify.py runs at import time: it reads the installer's /.zshrc and POSTs the raw file contents to the hardcoded endpoint...

MAL-2026-15810 Malicious code in gcphelpit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be1770a21667861e10f778ca485b270170e20a35a529bc2a041bc72266bdb7d The module src/gcphelpit/verify.py runs at import time: it reads the installer's /.zshrc and POSTs the raw file contents to the hardcoded endpoint...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy

CVE-2024-55591 - Fortinet FortiOS Authentication Bypass An ed...

CLEANSTART-2026-AX74205 Security fixes in vt-cli 1.1.1-r1

Package vt-cli version 1.1.1-r1 fixes 2 vulnerabilities: CVE-2026-39824, CVE-2026-56852...

CLEANSTART-2026-FA04759 Security fixes in vt-cli 1.3.1-r1

Package vt-cli version 1.3.1-r1 fixes 2 vulnerabilities: CVE-2026-39824, CVE-2026-56852...

CLEANSTART-2026-SX52692 Security fixes in vt-cli 1.0.1-r1

Package vt-cli version 1.0.1-r1 fixes 2 vulnerabilities: CVE-2026-39824, CVE-2026-56852...

CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce EMR Secure Shell SSH helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions...

puncia v0.36

PantheraP.uncia Official CLI utility for Subdomain Center & Exploit Observer Puncia is the official command-line client for two A.R.P. Syndicate intelligence APIs — point it at a domain, a brand, or a vulnerability ID and get structured JSON back in seconds, no browser required: 🕸️ Subdomain Cente...

PT-2026-84355

Name of the Vulnerable Software and Affected Versions OpenAI Codex CLI affected versions not specified OpenAI Codex Desktop affected versions not specified Description OpenAI Codex CLI and Codex Desktop misclassify certain PowerShell commands as safe due to a discrepancy in how the command-safety...

CVE-2026-19591: Improper Neutralization of Escape, Meta, or Control Sequences

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token --% differently than PowerShell itself. If a user opens an attacker-prepared...

CVE-2026-19592: External Control of System or Configuration Setting

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the repository-local core.fsmonitor setting. If a user opens or uses an attacker-prepared repository whose preserved .git/config sets...

PT-2026-84486

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A flaw in the command line interface allows for the improper processing of malformed input, which could enable an attacker to execute arbitrary commands with root privileges. Recommendations A...

Linux Distros Unpatched Vulnerability : CVE-2026-18654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow...

Ciphey v0.12.1

Ciphey Paste in text that's been encoded or encrypted. Ciphey works out how and hands you the plaintext. No key, no cipher name, no hints. Base64, hex, Caesar/ROT13, Vigenère, Morse code and 19 more, several layers deep. Install · Quick start · Features · Library · MCP · Docs · Discord ▶ Watch th...

[SECURITY] Fedora 43 Update: hcloud-1.67.0-1.fc43

A command-line interface for Hetzner Cloud...

CVE-2026-72924

A flaw was found in GitHub CLI. The gh codespace ports forward command, by default, exposes forwarded services on all local network interfaces. This allows a network-adjacent attacker to access these services through the user's machine while port forwarding is active, even if the original...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...