2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4390 more potentially affected by CVE-2026-41674 via @xmldom/xmldom (>=0.7.0, <=0.8.12)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.0.1, =0.0.2 - @abcd19/st-grid 3.1.0 and more Source cves: CVE-2026-41674 Source advisory: MEND:CVE-2026-41674...

CVE-2026-42338 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, npm, wazuh-dashboard-fips, kibana, wazuh-dashboard, librechat, actions-runner, renovate, graalvm, sqlpad, tileserver-gl-fips, commercial-gitlab-rails-ee-fips, lerna, pulumi, langfuse, saf, drupal, opensearch-dashboards, langfuse-fips, gemini-cli,...

NPM: Vercel: Non-interactive mode includes CLI arguments in suggested command output

NPM: Vercel: Non-interactive mode includes CLI arguments in suggested command output vulnerability discovered by ? in WordPress Npm vercel versions = 50.16.0, = 52.0.0...

GHSA-PGF8-2HGJ-GRQG Vercel: Non-interactive mode includes CLI arguments in suggested command output

Summary When the Vercel CLI runs in non-interactive mode --non-interactive or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

PT-2026-38406

Name of the Vulnerable Software and Affected Versions Vercel CLI versions 50.16.0 through 52.0.0 Description When running in non-interactive mode via the --non-interactive flag or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads containing suggested follow-up...

CLI Proxy API 代码问题漏洞

CLI Proxy API is an open-source CLI proxy server developed by Router-For.ME, which supports multi-model APIs. Version 6.9.29 of the CLI Proxy API has a code vulnerability that stems from the handling of the url parameter in the file internal/api/handlers/management/apitools.go. This vulnerability...

cf-cli-8.18.3+git.0.83ce51d9c-1.1 on GA media (moderate)

cf-cli-8.18.3+git.0.83ce51d9c-1.1 on GA media Announcement ID: openSUSE-SU-2026:10688-1 Rating: moderate Cross-References: CVE-2025-61729 CVSS scores: CVE-2025-61729 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61729 SUSE : 8.7...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +78 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: SNYK:JS-NITRO-16757947...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-44244 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-44244 Source advisory:...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-44244 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-44244 Source advisory: OSV:GHSA-V87R-6Q3F-2J67...

ironhide (>=1.0.0, <=1.0.7), rorm-cli (0.5.0) +1 more potentially affected by unknown CVE via rpassword (>=7.0.0, <=7.2.0)

rpassword CARGO version =7.0.0, =1.0.0, =0.1.0, =0.1.4 Source cves: unknown CVE Source advisory: OSV:GHSA-2P6R-X3VV-XQM2...

Google Fixes CVSS 10 Gemini CLI Vulnerability Enabling GitHub Issue-Based RCE

Google patches a CVSS 10 Gemini CLI vulnerability that allowed hackers to use prompt injection and privilege escalation for a full supply chain compromise...

io.micronaut.starter:micronaut-micronaut-cli (2.0.0.rc2), io.micronaut.starter:micronaut-starter-api (2.0.0.rc2) +27 more potentially affected by CVE-2026-44242 via io.micronaut:micronaut-inject (2.0.0.rc2)

io.micronaut:micronaut-inject MAVEN version 2.0.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-inject and may be impacted: - io.micronaut.starter:micronaut-micronaut-cli 2.0.0.rc2 - io.micronaut.starter:micronaut-starter-a...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-44243 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-44243 Source advisory: OSV:GHSA-7545-FCXQ-7J24...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2026-44243 via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2026-44243 Source advisory: OSV:GHSA-7545-FCXQ-7J24...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-44243 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-44243 Source advisory:...

CVE-2026-41898 vulnerabilities

Vulnerabilities for packages: ztunnel-fips, typst, sdp-k8s-injector, sentry-cli, valkey-ldap, rustup, sqlx, deno, sccache, komodo, bootc, guestproxyagent, rustls-openssl-client, vector, rpm-sequoia...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, azurite, npm, redisinsight, wazuh-dashboard-fips, dbgate-fips, gitlab-rails-ce, kibana, wazuh-dashboard, librechat, argo-workflows, actions-runner, renovate, py3-captum, tensorflow-gpu-jupyter, jupyter-base-notebook, nemo, sqlpad,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: guac, gitlab-rails-ce, gitea, scorecard, src-fingerprint-fips, chainctl, kaniko, melange, kots, mapotf-fips, crossplane, k9s-fips, gitaly-fips, argo-workflows-fips, grafana, cerbos-fips, flux, pulumi-language-yaml, syft-fips, kyverno, rancher-fleet, grafana-alloy-fip...