PT-2026-53321

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19 Description Improper handling of untrusted remote references allows server-side request forgery SSRF, a condition where a server is coerced into making requests to an unintended destination. The SQL stateme...

CVE-2026-13744: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL i...

CVE-2026-13752: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session...

PT-2026-53310

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19 Description Improper neutralization of local CLI parameters allows unintended SQL execution. A user can trigger this issue by providing crafted values to the Cortex SQL or object listing command paths,...

PT-2026-53546

| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via tar.extract without member validation | | Affected | src/praisonai/praisonai/cli/features/recipe.py:1170-1172 | Summary cmd unpack in the recipe CLI extracts .praison tar archives using raw...

PT-2026-53629

Summary The substitute utcp args method in cli communication protocol.py inserts user-controlled tool args values directly into shell command strings without any sanitization or escaping. These commands are then executed via /bin/bash -c Unix or powershell.exe -Command Windows, allowing an attack...

CVE-2026-13746: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the...

CVE-2026-13749: Improper Control of Generation of Code

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generate...

CVE-2026-13750: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as...

CVE-2026-13751: Server-Side Request Forgery (SSRF)

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. B...

CVE-2026-13748: Improper Limitation of a Pathname to a Restricted Directory

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: zitadel, kubescape-server-fips, opentelemetry-collector, external-secrets-operator-fips, etcd-fips, aactl, nerdctl, frankenphp-8.5, flux-source-controller-fips, frankenphp-8.4, knative-kafka-broker-fips, kots, kube-conformance, traefik, kyverno-fips, coder,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: zitadel, kubescape-server-fips, longhorn-cli, crossplane-provider-aws-rds, packer-fips, etcd-fips, crossplane-provider-aws-ecr, chainloop-control-plane-fips, crossplane-provider-aws-elb-fips, crossplane-provider-aws-rolesanywhere-fips, longhorn-manager, frankenphp-8....

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: zitadel, packer-fips, buildah, opentelemetry-collector, external-secrets-operator-fips, etcd-fips, aactl, nerdctl, frankenphp-8.5, frankenphp-8.4, knative-kafka-broker-fips, kots, teleport-operator-fips, kube-conformance, traefik, kyverno-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, zitadel, kubescape-server-fips, longhorn-cli, opentelemetry-collector, packer-fips, external-secrets-operator-fips, etcd-fips, apko, longhorn-manager, pulumi-kubernetes-operator, aactl, grype, nerdctl, frankenphp-8.5, flux-source-controller-fips,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: zitadel, kubescape-server-fips, longhorn-cli, crossplane-provider-aws-rds, packer-fips, etcd-fips, crossplane-provider-aws-ecr, chainloop-control-plane-fips, crossplane-provider-aws-elb-fips, crossplane-provider-aws-rolesanywhere-fips, longhorn-manager, frankenphp-8....

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: mods, datadog-agent, kine, apko, age, steampipe, docker-machine-driver-harvester, step-kms-plugin, step, eksctl, pulumi-language-java, policy-controller, gitlab-runner, syft, atlantis, crossplane-provider-azure-authorization, witness, chezmoi, step-issuer, flux,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux-source-controller, flux-image-automation-controller, skaffold, kine, trivy, external-secrets-operator, cilium-cli, loki, osv-scanner, cilium, kyverno, argocd-image-updater, cert-manager, falco-no-driver, chisel, gitea, mattermost, minio, istio, telegraf,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: kine, external-secrets-operator, cilium-cli, loki, cilium, kyverno, falco-no-driver, cert-manager, mattermost, minio, istio, telegraf, snyk-cli, zot, prometheus-operator, containerd, opentelemetry-collector, helm, prometheus, aactl, podman, buildah, spire-server,...

GO-2026-5656 Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go...