12714 matches found
CVE-2026-44479
CVE-2026-44479 affects Vercel’s AI Cloud CLI between versions 50.16.0 and 52.0.0. In non-interactive mode, commands that cannot complete autonomously emit JSON payloads with follow-up commands, and if a token is supplied on the CLI (via --token/-t), the token value is included verbatim in those s...
CVE-2026-44479
Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode --non-interactive or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the us...
7ghost-cli (>=1.17.6-next.0, <=1.18.4), @abtnode/core (>=1.0.15, <=1.1.9) +775 more potentially affected by CVE-2026-44724 via systeminformation (>=4.22.5, <=5.31.5)
systeminformation NPM version =4.22.5, =1.17.6-next.0, =1.0.15, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.26.4, =0.1.1, =0.1.1, =4.1.0-rc.4, =5.2.0-revision.1, =4.0.0-devnet.2-patch.0, =0.0.1-2.1-beta-provision, =2.2.0 and more Source cves: CVE-2026-44724 Source...
CVE-2026-45803
creationtimestamp| type| source ---|---|--- 2026-05-13 15:20:46+00:00| published-proof-of-concept| https://github.com/cli/cli/security/advisories/GHSA-crc3-h8v6-qh57...
CVE-2026-44295
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum,...
CVE-2026-44295 protobufjs-cli: Code injection in pbjs static output from crafted schema names
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum,...
@forwardimpact/libcodegen (>=0.1.47, <=0.1.52) potentially affected by CVE-2026-44295 via protobufjs-cli (2.0.1)
protobufjs-cli NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs-cli and may be impacted: - @forwardimpact/libcodegen =0.1.47, =0.1.52 Source cves: CVE-2026-44295 Source advisory: MEND:CVE-2026-44295...
CVE-2026-44295
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum,...
CVE-2026-44295 protobufjs-cli: Code injection in pbjs static output from crafted schema names
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum,...
@forwardimpact/libcodegen (>=0.1.47, <=0.1.52) potentially affected by CVE-2026-42290 via protobufjs-cli (2.0.1)
protobufjs-cli NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs-cli and may be impacted: - @forwardimpact/libcodegen =0.1.47, =0.1.52 Source cves: CVE-2026-42290 Source advisory: MEND:CVE-2026-42290...
10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1538 more potentially affected by CVE-2026-42290 via protobufjs-cli (>=1.0.0, <=1.1.3)
protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-42290 Source advisory: MEND:CVE-2026-42290...
CVE-2026-42290 protobufjs-cli: OS Command Injection
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through childprocess.exec. File paths containing shell metacharacters could therefore be interpreted by the shell inste...
CVE-2026-42290
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through childprocess.exec. File paths containing shell metacharacters could therefore be interpreted by the shell inste...
CVE-2026-42290
Summary: The vulnerability affects protobufjs-cli’s pbts command. In versions before 1.2.1 and 2.0.2, pbts builds a shell command string from input file paths and runs it via child_process.exec, allowing file paths containing shell metacharacters to be interpreted by the shell. This can enable OS...
CVE-2026-42290 protobufjs-cli: OS Command Injection
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through childprocess.exec. File paths containing shell metacharacters could therefore be interpreted by the shell inste...
agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)
authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: GHSA-R95X-QFJJ-FJJ2...
agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)
authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: SNYK:PYTHON-AUTHLIB-16643257...
agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)
authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...
EUVD-2026-29849
Command injection vulnerabilities exist in the command line interface CLI service accessed by the PAPI protocol of AOS-8 and AOS-10 Operating Systems. Successful exploitation of these vulnerabilities could allow an authenticated remote attacker to execute arbitrary commands on the underlying...
