PT-2026-53546

| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via tar.extract without member validation | | Affected | src/praisonai/praisonai/cli/features/recipe.py:1170-1172 | Summary cmd unpack in the recipe CLI extracts .praison tar archives using raw...

CVE-2026-13751: Server-Side Request Forgery (SSRF)

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. B...

PT-2026-53321

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19 Description Improper handling of untrusted remote references allows server-side request forgery SSRF, a condition where a server is coerced into making requests to an unintended destination. The SQL stateme...

PT-2026-53310

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19 Description Improper neutralization of local CLI parameters allows unintended SQL execution. A user can trigger this issue by providing crafted values to the Cortex SQL or object listing command paths,...

CVE-2026-13748: Improper Limitation of a Pathname to a Restricted Directory

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

CVE-2026-13746: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the...

CVE-2026-13744: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL i...

CVE-2026-13749: Improper Control of Generation of Code

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generate...

CVE-2026-13750: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, coder-fips, crossplane-provider-aws-athena-fips, nemo, crossplane-provider-aws-organizations, commercial-expanso-edge, crossplane-provider-aws-chime, knative-kafka-broker, crossplane-provider-aws-sqs-fips, cloudflared-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: vault-fips, coder-fips, seaweedfs-rocksdb, commercial-kyverno, nemo, commercial-expanso-edge, rancher, knative-kafka-broker, chisel, prometheus, external-secrets-operator, vitess, cloudbeat-fips, skaffold, keda-fips, frankenphp-8.3, knative-kafka-broker-fips,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: vault-fips, commercial-kyverno, nemo, commercial-expanso-edge, rancher, knative-kafka-broker, prometheus, external-secrets-operator, vitess, keda-fips, frankenphp-8.3, knative-kafka-broker-fips, harbor-fips, kubernetes, nerdctl, rancher-agent, upwind-agent, zot,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terraform-provider-acme-fips, coder-fips, crossplane-provider-aws-athena-fips, nemo, crossplane-provider-aws-organizations, commercial-expanso-edge, crossplane-provider-aws-chime, knative-kafka-broker, crossplane-provider-aws-sqs-fips, cloudflared-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: vault-fips, act, coder-fips, seaweedfs-rocksdb, argo-events-fips, commercial-kyverno, nemo, commercial-expanso-edge, rancher, knative-kafka-broker, gomplate-fips, chisel, prometheus, prometheus-podman-exporter-fips, syft, external-secrets-operator, chainctl, vitess,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-cd, flux-kustomize-controller, grype, melange, crossplane-provider-azure-sql, docker, flux-source-controller, neuvector-sigstore-interface, scorecard, helm, step-issuer, steampipe, cilium-cli, nfpm, argo-events, buildkitd, vault-benchmark, cosign, tflint,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: istio, flux-source-controller, trivy-operator, kubescape, external-secrets-operator, gitlab-kas, k3s, rancher-agent, kubernetes, helm, kots, skaffold, cilium-cli, opentelemetry-collector, falco-no-driver, prometheus-operator, aactl, containerd, loki, spire-server,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: istio, buildah, rancher-agent, external-secrets-operator, k3s, gitlab-kas, kubernetes, helm, kots, podman, cilium-cli, opentelemetry-collector, falco-no-driver, prometheus-operator, aactl, containerd, loki, spire-server, mattermost, cert-manager, external-dns, flux,...

GO-2026-5656 Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go...

GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli

GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...

GO-2026-5271 GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands in github.com/cli/cli...