Malicious Package

Overview claudcode-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2973 Malicious code in claudcode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1de8369f09912bb8724607f94c599ad3fcecfa78fa46e76985acbc600ad8791 The package claudcode-cli was found to contain malicious code. Source: ghsa-malware 6bdf49fafb69e5edbe0ee4aecb34c6d65f28e0dd917b228142fd71e6db486971...

Malicious code in claudcode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1de8369f09912bb8724607f94c599ad3fcecfa78fa46e76985acbc600ad8791 The package claudcode-cli was found to contain malicious code. Source: ghsa-malware 6bdf49fafb69e5edbe0ee4aecb34c6d65f28e0dd917b228142fd71e6db486971...

an-website (24.1.0), browserist (1.6.7) +5 more potentially affected by CVE-2026-41066 via lxml (5.0.0)

lxml PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - an-website 24.1.0 - browserist 1.6.7 - ena-upload-cli =0.6.3, =5.0.0, =0.1.0, =0.5.0 - stockplot 2.0.3 Source cves: CVE-2026-41066 Source advisory:...

aztarna (1.0.0), gluetool (>=1.25.0, <=1.26.0) +4 more potentially affected by CVE-2026-41066 via lxml (4.2.4)

lxml PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aztarna 1.0.0 - gluetool =1.25.0, =1.0.0, =1.0.0, =0.4.1, =1.4.0, =1.5.2 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4JFW...

CVE-2026-40602 hass-cli: Handling of user-supplied Jinja2 templates

The Home Assistant Command-line interface hass-cli is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no...

CVE-2026-40602 hass-cli: Handling of user-supplied Jinja2 templates

The Home Assistant Command-line interface hass-cli is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no...

boss-cli (>=1.0.0a18, <=1.0.3), lore (0.4.36) +1 more potentially affected by CVE-2026-28684 via python-dotenv (0.6.5)

python-dotenv PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - boss-cli =1.0.0a18, =0.1.16, =0.1.20 Source cves: CVE-2026-28684 Source advisory: OSV:GHSA-MF9W-MJ56-HR94...

EUVD-2026-24079

This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing brute force attacks against administrative...

CVE-2026-41036 Command Injection Vulnerability in Quantum Networks Router QN-I-470

This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary OS commands on the targeted device. Successful exploitation of this...

CVE-2026-41036: Improper Neutralization of Special Elements used in an OS Command

This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. An authenticated remote attacker could exploit this vulnerability by injecting arbitrary OS commands on the targeted device. Successful exploitation of this...

CVE-2026-40602: Improper Control of Generation of Code

The Home Assistant Command-line interface hass-cli is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no...

boss-cli (>=1.0.0a18, <=1.0.3), lore (0.4.36) +1 more potentially affected by CVE-2026-28684 via python-dotenv (0.6.5)

python-dotenv PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - boss-cli =1.0.0a18, =0.1.16, =0.1.20 Source cves: CVE-2026-28684 Source advisory: OSV:PYSEC-2026-2270...

tempo-cli-2.10.4-1.1 on GA media (moderate)

tempo-cli-2.10.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:10578-1 Rating: moderate Cross-References: CVE-2026-25679 CVSS scores: CVE-2026-25679 SUSE : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2026-25679 SUSE : 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:...

OPENSUSE-SU-2026:10578-1 tempo-cli-2.10.4-1.1 on GA media

These are all security issues fixed in the tempo-cli-2.10.4-1.1 package on the GA media of openSUSE Tumbleweed...

elFinder: Command injection in resize background color parameter when using ImageMagick CLI

Severity High bg can be injected into shell command construction, leading to possible RCE in affected configurations. Summary elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: gitlab-kas, eksctl, argo-cd, linkerd2, datadog-agent, helm, kpt, trivy, aws-node-termination-handler, infinispan-operator, argo-workflows, cri-tools, cloudnative-pg, rancher, jitsucom-bulker, k9s, kube-arangodb, envoy-gateway, kargo, teleport, argocd-image-updater,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: gitlab-kas, eksctl, argo-cd, linkerd2, datadog-agent, helm, kpt, trivy, aws-node-termination-handler, infinispan-operator, argo-workflows, cri-tools, cloudnative-pg, rancher, jitsucom-bulker, k9s, kube-arangodb, envoy-gateway, kargo, teleport, argocd-image-updater,...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, kdash, sdp-k8s-injector, buck2, qdrant, linkerd-extension-init, komodo, garage, xh, zola, wasm-pack, linkerd2, cargo-audit, zellij, sentry-cli, ntpd-rs, sqlx, deno, wasmtime, mise, berg, shadowsocks-rust, py3-xet-core, rustup, sccache, lakekeeper,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, kdash, sdp-k8s-injector, buck2, qdrant, linkerd-extension-init, komodo, garage, xh, zola, wasm-pack, linkerd2, cargo-audit, zellij, sentry-cli, ntpd-rs, sqlx, deno, wasmtime, mise, berg, shadowsocks-rust, py3-xet-core, rustup, sccache, lakekeeper,...