CVE-2026-42866: Improper Limitation of a Pathname to a Restricted Directory

Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's writetxt, writecsv, writejson, and commented-but-shipping scanfile helpers open their output as openf"user. ", where user comes unsanitized from the -u CLI flag or any line of a -U usernames file. A...

PT-2026-39901

Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 1.0.43 Description An issue exists where a malicious bare git repository nested inside a project directory can lead to arbitrary code execution when the agent performs git operations. By exploiting git's...

N4V3R41N-Suite

N4V3R41N: The Ultimate Unified iOS Exploit & Bypass Suite !V...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: spire-server, neuvector-sigstore-interface, flux-source-controller, goreleaser, cloudbeat, policy-controller-fips, kyverno-notation-aws-fips, docker-cli-buildx, chainctl, tekton-chains, kyverno-notation-aws, policy-controller, cosign, slsa-verifier, dagger, teleport,...

aperture-cli (>=0.0.0.dev1, <=1.0.0), aperturelib (>=0.0.0.dev1, <=1.0.0) +27 more potentially affected by CVE-2026-42308 via pillow (5.0.0)

pillow PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aperture-cli =0.0.0.dev1, =0.0.0.dev1, =0.0.1.dev1, =0.0.2, =0.2.0, =0.1.2, =0.1.9, =0.1.0, =1.0.0, =0.7.0, =0.9.8, =1.0.1, =1.0.2.post2 and more...

banner-ad-toolkit (>=0.3.1, <=0.3.2), bcipy (>=1.1.1, <=1.2.0) +64 more potentially affected by CVE-2026-42308 via pillow (4.3.0)

pillow PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - banner-ad-toolkit =0.3.1, =1.1.1, =2.2.0, =1.4.9, =2.0.0, =0.1.0a0, =1.1.0, =0.23.0, =0.2.6, =0.6.0, =2.3.0.18073018, =2.3.6.19012721 and more Sourc...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: nova, undock, manifest-tool, mattermost, step-ca, kbld, bazelisk, conjur-cli, terraform-provider-acme, tkn, argo-events, controller-gen, atlantis, kubernetes, grafana-mimir, aws-otel-collector, otel-cli, kaf, skopeo, guac, kube-fluentd-operator, mesosphere-vsphere-cs...

mvrk (>=1.2.0, <=1.2.1), repo-cli (>=0.0.1.8, <=0.0.1.14) potentially affected by CVE-2026-44897 via mistune (2.0.0a4)

mistune PYPI version 2.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - mvrk =1.2.0, =0.0.1.8, =0.0.1.14 Source cves: CVE-2026-44897 Source advisory: OSV:GHSA-V87V-83H2-53W7...

mvrk (>=1.2.0, <=1.2.1), repo-cli (>=0.0.1.8, <=0.0.1.14) potentially affected by CVE-2026-44708 via mistune (2.0.0a4)

mistune PYPI version 2.0.0a4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - mvrk =1.2.0, =0.0.1.8, =0.0.1.14 Source cves: CVE-2026-44708 Source advisory: OSV:GHSA-8G87-J6Q8-G93X...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-67326 Source advisory:...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2026-67326 via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6322 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6322 Source advisory: OSV:GHSA-V39H-62P7-JPJC...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6321 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6321 Source advisory: GHSA-Q3J6-QGPJ-74H6...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

@activepieces/piece-amazon-textract (>=0.2.0, <=0.3.0), @activepieces/piece-salesforce (0.7.2) +3 more potentially affected by CVE-2026-44665 via fast-xml-builder (1.1.4)

fast-xml-builder NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on fast-xml-builder and may be impacted: - @activepieces/piece-amazon-textract =0.2.0, =0.2.1, =0.0.4, =10.4.0, =10.5.0 Source cves: CVE-2026-44665 Source advisory:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44008 via vm2 (>=3.0.0, <=3.11.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: zipkin, apache-nifi-registry, keycloak-config-cli, thingsboard...

GHSA-WWPQ-F5C3-7HVX vulnerabilities

Vulnerabilities for packages: zipkin, apache-nifi-registry, keycloak-config-cli, thingsboard...

CVE-2026-40973 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, nacos-docker, kafbat-ui, kafbat-ui-fips, conductor-fips, apache-nifi-registry, conductor, thingsboard, zipkin, keycloak-config-cli, nacos...