PT-2026-29664

Name of the Vulnerable Software and Affected Versions goshs versions 1.1.0 through 2.0.0-beta.2 Description goshs, a SimpleHTTPServer written in Go, has a flaw where the Share Token mechanism can be bypassed. This bypass allows unauthorized access to all goshs functionalities, including code...

CVE-2026-34603: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the...

PT-2026-29822

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.15 through 4.5.68 Description PraisonAI is a multi-agent teams system. The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.open process without validation, allowlist...

Telnet CLI Arbitrary Command Execution

The vulnerability of the Telnet command-line interface CLI of TP-Link’s TL-MR6400 v5.3 router software relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary system command...

GHSA-M8X7-R2RG-VH5G FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +250 more potentially affected by CVE-2026-2950 via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2026-2950 Source advisory: MEND:CVE-2026-2950...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, melange, grype-fips, skaffold, gitea-fips, gomplate, pulumi-kubernetes-operator, crossplane-fips, gitlab-runner-fips, src-fingerprint-fips, cerbos, flux-source-controller-fips, xeol, kubescape, bom, wolfictl,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, melange, grype-fips, skaffold, gitea-fips, gomplate, pulumi-kubernetes-operator, crossplane-fips, gitlab-runner-fips, src-fingerprint-fips, cerbos, flux-source-controller-fips, xeol, kubescape, bom, wolfictl,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, melange, grype-fips, skaffold, gitea-fips, gomplate, pulumi-kubernetes-operator, crossplane-fips, gitlab-runner-fips, src-fingerprint-fips, cerbos, flux-source-controller-fips, xeol, kubescape, bom, wolfictl,...

aba-cli-scrapper (>=0.6.0, <=0.7.6), agixt (>=1.7.0, <=1.7.2) +130 more potentially affected by CVE-2026-34073 via cryptography (43.0.1)

cryptography PYPI version 43.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aba-cli-scrapper =0.6.0, =1.7.0, =3.0.0, =2.9.0, =0.2.1, =0.0.81, =1.0.648, =1.0.2, =0.1.0.post173, =0.1.1, =1.1.45, =0.0.1, =0.0.5 and...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-34073 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

ais-dom (>=0.92.5, <=0.95.7), bitwarden-simple-cli (>=1.0.0, <=1.3.1) +29 more potentially affected by CVE-2026-34073 via cryptography (2.6.1)

cryptography PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.92.5, =1.0.0, =1.7.1, =0.2.5, =0.0.0, =0.0.17, =0.0.1.dev33, =0.1.8, =0.4.3, =0.1.0, =1.0.5 - ezissue-br 1.0.0 and more Sourc...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-34073 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

algorin-cli (>=0.0.1, <=0.21.0), alita-sdk (>=0.0.1, <=0.0.16) +1 more potentially affected by CVE-2026-34070 via langchain-core (0.1.30)

langchain-core PYPI version 0.1.30 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - algorin-cli =0.0.1, =0.0.1, =0.0.2, =0.0.6 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-34070 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

aa-rag (>=0.4.2, <=0.4.3), ai-parrot (>=0.5.18, <=0.6.4) +11 more potentially affected by CVE-2026-34070 via langchain-core (0.3.51)

langchain-core PYPI version 0.3.51 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - aa-rag =0.4.2, =0.5.18, =2025.4.71026, =2025.5.11802, =0.1.0, =2025.4.101146, =2025.9.111721, =2025.4.181139, =2025.5.91122, =0.1.8...