pdd-cli (>=0.0.28, <=0.0.94) potentially affected by CVE-2026-34070 via langchain-core (0.3.56)

langchain-core PYPI version 0.3.56 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - pdd-cli =0.0.28, =0.0.94 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

CVE-2026-4926 vulnerabilities

Vulnerabilities for packages: saf, thingsboard, langfuse-fips, langfuse, code-server, opensearch-dashboards, redisinsight, kibana, vitess, wazuh-dashboard, tileserver-gl, gemini-cli, tileserver-gl-fips, opensearch-dashboards-fips...

CVE-2026-4923 vulnerabilities

Vulnerabilities for packages: saf, thingsboard, langfuse-fips, langfuse, code-server, opensearch-dashboards, redisinsight, kibana, vitess, wazuh-dashboard, tileserver-gl, gemini-cli, tileserver-gl-fips, opensearch-dashboards-fips...

GHSA-27V5-C462-WPQ7 vulnerabilities

Vulnerabilities for packages: saf, thingsboard, langfuse-fips, langfuse, code-server, opensearch-dashboards, redisinsight, kibana, vitess, wazuh-dashboard, tileserver-gl, gemini-cli, tileserver-gl-fips, opensearch-dashboards-fips...

GHSA-J3Q9-MXJG-W52F vulnerabilities

Vulnerabilities for packages: saf, thingsboard, langfuse-fips, langfuse, code-server, opensearch-dashboards, redisinsight, kibana, vitess, wazuh-dashboard, tileserver-gl, gemini-cli, tileserver-gl-fips, opensearch-dashboards-fips...

PT-2026-32070

Summary Passwords passed via the --password / -p CLI argument in openssl encrypt/modules/crypt cli subparser.py at lines 150-154 are visible to any user on the system via ps aux or /proc/pid/cmdline. Affected Code python subparser.add argument "--password", "-p", help="Password will prompt if not...

CVE-2026-34200: Missing Authentication for Critical Function

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (4.1.0), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (4.1.0) +82 more potentially affected by CVE-2026-34359 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (4.1.0)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 4.1.0 - ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserv...

CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it...

CVE-2026-33941

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler "bin/handlebars" / "lib/precompiler.js" concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript ...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-34073 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

agentstack-cli (>=0.5.0rc4, <=0.7.1), amiibo-converter (0.2.0) +264 more potentially affected by CVE-2026-34073 via cryptography (>=46.0.0, <=46.0.5)

cryptography PYPI version =46.0.0, =0.5.0rc4, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1, =0.13.12, =0.1.3, =3.8.9, =0.2.50, =0.2.57 and more Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

azure-cli (>=2.0.58, <=2.0.66), azure-cli-appservice (>=0.2.13, <=0.2.20) +27 more potentially affected by CVE-2026-34073 via cryptography (2.4.2)

cryptography PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - azure-cli =2.0.58, =0.2.13, =1.5.5, =1.0.0b6, =18.4.0, =0.3.0rc1, =1.0.3, =0.1.0, =1.2.8, =1.0.5, =2.1.12 and more Source cves:...

askflow-cli (1.0.0), atlassian-jwt-auth (>=8.0.2, <=9.0.0) +68 more potentially affected by CVE-2026-34073 via cryptography (3.2.1)

cryptography PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - askflow-cli 1.0.0 - atlassian-jwt-auth =8.0.2, =0.0.9, =0.2.7a0, =0.0.2, =0.0.1a12, =0.6.0, =3.1.12, =2.1.0, =1.0.0, =0.0.19, =0.7.1,...

acmetk (0.0.2), aioasuswrt (1.3.3) +136 more potentially affected by CVE-2026-34073 via cryptography (3.3.2)

cryptography PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - acmetk 0.0.2 - aioasuswrt 1.3.3 - ais-dom =2021.3.0b4, =1.6.0, =10.0.0, =1.10.0, =1.8.0, =2.20.0, =2.20.0, =1.0.1, =0.3.27, =0.5.6, =0.8...

algorin-cli (>=0.0.1, <=0.21.0), alita-sdk (>=0.0.1, <=0.0.16) +1 more potentially affected by CVE-2026-34070 via langchain-core (0.1.30)

langchain-core PYPI version 0.1.30 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - algorin-cli =0.0.1, =0.0.1, =0.0.2, =0.0.6 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

pdd-cli (>=0.0.28, <=0.0.94) potentially affected by CVE-2026-34070 via langchain-core (0.3.56)

langchain-core PYPI version 0.3.56 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - pdd-cli =0.0.28, =0.0.94 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

datasetpipeline (>=0.1.7, <=0.2.1), document-qa-engine (>=0.5.1, <=0.6.0) +2 more potentially affected by CVE-2026-34070 via langchain-core (0.3.61)

langchain-core PYPI version 0.3.61 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - datasetpipeline =0.1.7, =0.5.1, =0.1.1, =0.1.7 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-34070 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Summary The Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI...