@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55660 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55660 Source advisory: SNYK:JS-TINACMS-17420390...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55660 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55660 Source advisory: OSV:GHSA-G5QX-H5F3-MP2F...

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

Description Summary @tinacms/cli contains a Remote Code Execution vulnerability in its Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINAINTERNAL:::.?:::" inside the stringified collection JSON. User-supplied label and name fiel...

Arbitrary Code Injection

Overview @tinacms/cli is a package used to set up your project with Tina Cloud configuration, and run a local version of the Tina Cloud content-api. Affected versions of this package are vulnerable to Arbitrary Code Injection through the addVariablesToCode/makeFieldsWithInternalCode process in...

GHSA-4936-9HRH-QQPW @tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

Description Summary @tinacms/cli contains a Remote Code Execution vulnerability in its Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "TINAINTERNAL:::.?:::" inside the stringified collection JSON. User-supplied label and name fiel...

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

Impact A path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint rewind to write attacker-controlled transcript data outside of the expected session...

SUSE-SU-2026:22218-1 Security update for sqlite3

This update for sqlite3 fixes the following issues Update to 3.53.2: - CVE-2026-11822: memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution bsc1268012. - CVE-2026-11824: heap-based...

@agenticmail/cli (>=0.5.57, <=0.8.36), agenticmail (>=0.3.0, <=0.5.56) potentially affected by CVE-2026-57494 via @agenticmail/api (>=0.3.3, <=0.7.21)

@agenticmail/api NPM version =0.3.3, =0.5.57, =0.3.0, =0.5.56 Source cves: CVE-2026-57494 Source advisory: OSV:GHSA-HJWC-26PJ-V3PM...

@tinacms/app (>=0.0.0-574b548-20260304015858, <=2.5.5), @tinacms/cli (>=0.0.0-1d830a0-20260128234746, <=2.5.0) +1 more potentially affected by CVE-2026-55661 via tinacms (>=3.0.0, <=3.9.2)

tinacms NPM version =3.0.0, =0.0.0-574b548-20260304015858, =0.0.0-1d830a0-20260128234746, =0.1.12, =0.2.14 Source cves: CVE-2026-55661 Source advisory: SNYK:JS-TINACMS-17420373...

@angular-devkit/build-angular (22.1.0-next.0), @oslokommune/auth-bff (>=2.0.1, <=2.2.1) +2 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)

http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @angular-devkit/build-angular 22.1.0-next.0 - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves:...

@5minds/processcube_engine (>=19.0.0-beta.11, <=20.0.0-renovate-fd1892-me5sbqz0), @angular-devkit/build-angular (>=20.0.0-rc.0, <=22.1.0-next.0) +52 more potentially affected by CVE-2026-55388 via piscina (>=5.0.0, <=5.1.4)

piscina NPM version =5.0.0, =19.0.0-beta.11, =20.0.0-rc.0, =20.0.0-rc.0, =1.0.0, =21.2.2-depup.0, =21.2.2-depup.0, =1.0.0, =5.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =0.1.0, =0.1.26, =4.0.0-beta.1, =4.2.1 and more Source cves:...

PT-2026-53138

Summary The published npm package praisonai exports a TypeScript SandboxExecutor with a network-isolated mode. The CLI lists that mode as: text network-isolated No network access proxy blocked The implementation does not create a network namespace, firewall rule, socket filter, or proxy-enforced...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +762 more potentially affected by CVE-2026-6733 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.26.4, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-6733 Source advisory: SNYK:JS-UNDICI-17372752...

@aegis-scan/core (>=0.18.1, <=0.19.0), @aegis-scan/reporters (>=0.18.4, <=0.19.0) +437 more potentially affected by CVE-2026-9697 via undici (>=7.24.0, <=7.27.2)

undici NPM version =7.24.0, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.1.8, =0.1.7, =21.2.4, =21.2.4, =0.1.0, =0.18.0, =0.1.0, =0.4.0, =0.1.0, =0.0.1, =0.1.2 and more Source cves: CVE-2026-9697 Source advisory: SNYK:JS-UNDICI-17372609...

CVE-2026-20246

Summary: CVE-2026-20246 affects Cisco Umbrella Virtual Appliance. A vulnerability in the vmadmin CLI allows an authenticated, local attacker with vmadmin privileges to escalate to root by abusing certain commands at the CLI. The root-cause is insufficient validation of user-supplied commands in v...

CVE-2026-20246: Improper Privilege Management

A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this...

The vulnerability of the cli_history parameter in the command-line tool for interacting with Amazon Web Services AWS CLI allows a attacker to trigger a service failure.

The vulnerability of the clihistory parameter in the AWS CLI command line tool, which is used to interact with Amazon Web Services, is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

Important: Red Hat Security Advisory: Helm CLI v4.1.4 release

General availability release of Helm CLI v4.1.4. Helm is the package manager for Kubernetes, used to define, install, and upgrade applications as reusable charts. This release delivers the Helm v4.1.4 binaries built and distributed by Red Hat...

Malicious code in stripe-cli-init-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05bd1dbc9732ef80aca27acad964c041b74e646e26cf4947ad34807c41d2c4a8 Package name 'stripe-cli-init-plugin' impersonates the Stripe CLI ecosystem and ships a bin script bin/run.js that, when invoked via npx...

MAL-2026-5899 Malicious code in stripe-cli-init-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05bd1dbc9732ef80aca27acad964c041b74e646e26cf4947ad34807c41d2c4a8 Package name 'stripe-cli-init-plugin' impersonates the Stripe CLI ecosystem and ships a bin script bin/run.js that, when invoked via npx...