@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-33750 via brace-expansion (>=0.0.0, <=1.1.11)

brace-expansion NPM version =0.0.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =0.0.0, =0.0.3, =0.1.0 and more Source cves: CVE-2026-33750 Source advisory: MEND:CVE-2026-33750...

jo-cli (1.0.2) potentially affected by CVE-2026-33750 via brace-expansion (3.0.0)

brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-33750 Source advisory: MEND:CVE-2026-33750...

CVE-2026-33747 vulnerabilities

Vulnerabilities for packages: conftest, trivy-operator, osv-scanner, zot, podman, buildah, scorecard, kaniko, trivy, skaffold, docker-cli-buildx, docker-compose, guac, kubescape...

GHSA-4C29-8RGM-JVJJ vulnerabilities

Vulnerabilities for packages: conftest, trivy-operator, osv-scanner, zot, podman, buildah, scorecard, kaniko, trivy, skaffold, docker-cli-buildx, docker-compose, guac, kubescape...

CVE-2026-33748 vulnerabilities

Vulnerabilities for packages: conftest, trivy-operator, osv-scanner, zot, podman, buildah, scorecard, kaniko, trivy, skaffold, docker-cli-buildx, docker-compose, guac, kubescape...

GHSA-4VRQ-3VRQ-G6GG vulnerabilities

Vulnerabilities for packages: conftest, trivy-operator, osv-scanner, zot, podman, buildah, scorecard, kaniko, trivy, skaffold, docker-cli-buildx, docker-compose, guac, kubescape...

CVE-2026-33748 vulnerabilities

Vulnerabilities for packages: conftest, kaniko, skaffold, docker-cli-buildx-fips, kaniko-fips, guac, kubescape-server-fips, docker-fips, conftest-fips, trivy-operator-fips, buildah-fips, livekit-cli, cloudbeat, podman-fips, trivy-operator, cloudbeat-fips, docker-cli-buildx, zot, trivy,...

GHSA-4VRQ-3VRQ-G6GG vulnerabilities

Vulnerabilities for packages: conftest, kaniko, skaffold, docker-cli-buildx-fips, kaniko-fips, guac, kubescape-server-fips, docker-fips, conftest-fips, trivy-operator-fips, buildah-fips, livekit-cli, cloudbeat, podman-fips, trivy-operator, cloudbeat-fips, docker-cli-buildx, zot, trivy,...

CVE-2026-33747 vulnerabilities

Vulnerabilities for packages: conftest, kaniko, skaffold, docker-cli-buildx-fips, kaniko-fips, guac, kubescape-server-fips, docker-fips, conftest-fips, trivy-operator-fips, buildah-fips, livekit-cli, cloudbeat, podman-fips, trivy-operator, cloudbeat-fips, docker-cli-buildx, zot, trivy,...

PT-2026-28312

Name of the Vulnerable Software and Affected Versions Coverity Connect affected versions not specified Description The authentication logic in the command line tooling for Coverity Connect is missing an error handler, leading to a potential authentication bypass. An attacker with access to the...

4itech-schematics (>=11.3.0-2, <=11.7.0-5), @4itech/schematics (11.7.0) +71 more potentially affected by CVE-2026-33671 via picomatch (3.0.1)

picomatch NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on picomatch and may be impacted: - 4itech-schematics =11.3.0-2, =10.0.0-alpha.1, =10.0.0-alpha.1, =10.0.0-alpha.1, =0.1700.0-rc.3, =0.1700.0-rc.3, =17.0.0-rc.3, =0.1700.0-rc.3,...

GHSA-RVQR-HRCC-J9VV OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

Summary Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

External Control of Critical State Data

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of Critical State Data in the CLI routing process after failed service resolution, where Bonjour and DNS-SD TXT metadata could still influence the chosen target. An...

OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

Summary Bonjour and DNS-SD TXT metadata could still steer CLI routing even when actual service resolution failed, allowing unresolved hints to influence the chosen target. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

CVE-2021-4474 Ruckus AP CLI Arbitrary File Read Allows Authenticated Remote File Access

Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows authenticated remote attackers with administrative privileges to read arbitrary files from the underlying filesystem. Attackers can exploit this vulnerability to access sensitive...

@antora/cli (>=2.3.2, <=3.0.0-alpha.9), @antora/playbook-builder (>=2.3.2, <=3.0.0-alpha.9) +110 more potentially affected by CVE-2026-33864 via convict (>=6.0.0, <=6.2.4)

convict NPM version =6.0.0, =2.3.2, =2.3.2, =2.3.2, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-33864 Source advisory: OSV:GHSA-44FC-8FM5-Q62H...

jo-cli (1.0.2) potentially affected by CVE-2026-33750 via brace-expansion (3.0.0)

brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-33750 Source advisory: SNYK:JS-BRACEEXPANSION-15789759...

jo-cli (1.0.2) potentially affected by CVE-2026-33750 via brace-expansion (3.0.0)

brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-33750 Source advisory: OSV:GHSA-F886-M6HF-6M8V...

jo-cli (1.0.2) potentially affected by CVE-2026-33750 via brace-expansion (3.0.0)

brace-expansion NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on brace-expansion and may be impacted: - jo-cli 1.0.2 Source cves: CVE-2026-33750 Source advisory: GHSA-F886-M6HF-6M8V...

CVE-2025-15518

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the...