CVE-2025-53870

An improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2...

CVE-2026-7220

A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-mcp.mjs of the component fastlycli Tool. The manipulation of the argument command leads to os command injection. It is possible to initiate...

CVE-2026-35255

Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily exploitable vulnerability allows unauthenticated attacker to compromise Oracle Cloud Native Environment Command Line...

CVE-2026-35491

FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, Pi-hole FTL supports a CLI password feature webserver.api.clipw that creates “CLI” API sessions intended to be read-only for configuration changes. While /api/config...

CVE-2026-42994

Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident...

CVE-2026-48103

7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM Windows Imaging archive handler's security descriptor lookup. In CHandler::GetSecurity CPP/7zip/Archive/Wim/WimHandler.cpp, the per-image SecurOffsets table...

Security update for jq

This update for jq fixes the following issue CVE-2026-33948: CLI input parsing may allow validation bypass via embedded NUL bytes bsc1262043 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

Malicious code in autotel-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9746e4768872ec865677aee5e0616ec2bddc7d5d26e9c58bffd5541533612d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-50233: Exposure of Information Through Directory Listing

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service TCP port 9090 and the HTTP JSON-RPC endpoint /jsonrpc.js. The query accepts a folder parameter and lists its contents with no restriction to the...

Lyrion Music Server 9.2.0 Arbitrary Directory Listing

Summary Lyrion Music Server formerly Logitech Media Server, and often abbreviated as "LMS" is open-source software which can control and serve stream music to a wide range of physical and virtual audio players called Squeezeboxes. Lyrion Music Server can stream your local music collection, intern...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the configserver process. An attacker can access and modify sensitive configuration and secret data by sending cross-origin GraphQL requests to the local development server without...

GHSA-W2Q5-6Q6X-X959 vulnerabilities

Vulnerabilities for packages: flagger-fips, helm-mapkubeapis, image-factory-fips, flux-kustomize-controller-fips, vault-env, crossplane-provider-azure-resources, k8sgateway-fips, kubevirt-cdi-operator, nrdot-collector, crossplane-provider-aws-kafkaconnect, crossplane-provider-aws-ds-fips,...

CVE-2026-20245: Improper Encoding or Escaping of Output

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplyi...

Linux Distros Unpatched Vulnerability : CVE-2026-48501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: prometheus, prometheus-operator, snyk-cli, fq, istio, gitea, hydra, helm, falco-no-driver, traefik, crossplane-provider-aws-elasticache, grafana-pyroscope, external-secrets-operator, step-issuer, terraform-provider-acme, kine, minio, zot, flux, kubernetes-dashboard,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: prometheus, prometheus-operator, snyk-cli, fq, istio, gitea, hydra, helm, falco-no-driver, traefik, crossplane-provider-aws-elasticache, grafana-pyroscope, external-secrets-operator, step-issuer, terraform-provider-acme, kine, minio, zot, flux, kubernetes-dashboard,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: prometheus, prometheus-operator, snyk-cli, fq, istio, gitea, hydra, helm, falco-no-driver, traefik, crossplane-provider-aws-elasticache, grafana-pyroscope, external-secrets-operator, step-issuer, terraform-provider-acme, kine, minio, zot, flux, kubernetes-dashboard,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: prometheus, prometheus-operator, snyk-cli, fq, istio, gitea, hydra, helm, falco-no-driver, traefik, crossplane-provider-aws-elasticache, grafana-pyroscope, external-secrets-operator, step-issuer, terraform-provider-acme, kine, minio, zot, flux, kubernetes-dashboard,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: prometheus, prometheus-operator, snyk-cli, fq, istio, gitea, hydra, helm, falco-no-driver, traefik, crossplane-provider-aws-elasticache, grafana-pyroscope, external-secrets-operator, step-issuer, terraform-provider-acme, kine, minio, zot, flux, kubernetes-dashboard,...