GHSA-6V2J-VR4H-F632 `finch_cli_rust` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finchcli to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reportin...

CVE-2026-26014 vulnerabilities

Vulnerabilities for packages: k3s, livekit-egress, livekit-server, rke2-runtime, ipfs-cluster, ipfs-cluster-fips, kubo, livekit-cli, telegraf, spegel, rke2-runtime-fips, kubo-fips, op-geth, spegel-fips, livekit-server-fips...

Malicious Package

Overview node-dotenv-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in node-dotenv-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b47bebee6a74c00d3be10fad072e05074a62b29205377f682463290bad39c3 The package node-dotenv-cli was found to contain malicious code. Source: ghsa-malware 5bb66069e2bde985ae448962eaaf6373cd54aa2cd51fb20a0fef26ecb5dee2d...

MAL-2026-853 Malicious code in node-dotenv-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b47bebee6a74c00d3be10fad072e05074a62b29205377f682463290bad39c3 The package node-dotenv-cli was found to contain malicious code. Source: ghsa-malware 5bb66069e2bde985ae448962eaaf6373cd54aa2cd51fb20a0fef26ecb5dee2d...

CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

[SECURITY] Fedora 42 Update: rust-oo7-cli-0.3.3-5.fc42

System keyring access from the terminal...

CVE-2026-26029: Improper Neutralization of Special Elements used in an OS Command

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of childprocess.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to...

agentstack-cli (>=0.5.0rc4, <=0.6.1), artifact-ddd (>=0.0.1, <=0.0.3) +144 more potentially affected by CVE-2026-26007 via cryptography (>=46.0.0, <=46.0.4)

cryptography PYPI version =46.0.0, =0.5.0rc4, =0.0.1, =0.13.12, =3.8.9, =0.2.50, =0.7.0, =3.0.0a1, =0.4.6, =1.1.56, =1.0.3, =4.7.0, =1.28.0rc1, =1.29.0 and more Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

azure-cli (>=2.0.58, <=2.0.66), azure-cli-appservice (>=0.2.13, <=0.2.20) +27 more potentially affected by CVE-2026-26007 via cryptography (2.4.2)

cryptography PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - azure-cli =2.0.58, =0.2.13, =1.5.5, =1.0.0b6, =18.4.0, =0.3.0rc1, =1.0.3, =0.1.0, =1.2.8, =1.0.5, =2.1.12 and more Source cves:...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-26007 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

airflow-run (0.4.9), ais-dom (>=0.117.0b0, <=2021.2.4) +49 more potentially affected by CVE-2026-26007 via cryptography (3.2.0)

cryptography PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - airflow-run 0.4.9 - ais-dom =0.117.0b0, =2.0.1.dev14, =2.0.2 - azureml-accel-models 1.23.0 - azureml-cli-common 1.23.0 -...

ali2b-cli-scrapper (>=1.0.0, <=1.0.1), ambient-edge-server (>=0.1.2, <=0.2.4) +64 more potentially affected by CVE-2026-26007 via cryptography (42.0.7)

cryptography PYPI version 42.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ali2b-cli-scrapper =1.0.0, =0.1.2, =0.2.13, =0.1.10, =2.1.0rc1, =0.3.0, =0.3.9, =2.7.0, =0.1.2, =0.1.3 - edx-repo-tools 1.0.0 and more...

3lc (>=2.3.84, <=2.11.2), aba-cli-scrapper (>=0.1.0, <=0.5.6) +894 more potentially affected by CVE-2026-26007 via cryptography (42.0.8)

cryptography PYPI version 42.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - 3lc =2.3.84, =0.1.0, =2.3.57, =0.1.0, =0.4.0, =0.1.0, =0.0.1, =0.1.1, =1.0.0a1, =4.3.0, =0.12.0, =0.0.1rc1, =6.6.0rc1 and more Source...

agentstack-cli (>=0.5.0rc4, <=0.6.1), artifact-ddd (>=0.0.1, <=0.0.3) +144 more potentially affected by CVE-2026-26007 via cryptography (>=46.0.0, <=46.0.4)

cryptography PYPI version =46.0.0, =0.5.0rc4, =0.0.1, =0.13.12, =3.8.9, =0.2.50, =0.7.0, =3.0.0a1, =0.4.6, =1.1.56, =1.0.3, =4.7.0, =1.28.0rc1, =1.29.0 and more Source cves: CVE-2026-26007 Source advisory: GHSA-R6PH-V2QM-Q3C2...

agentstack-cli (>=0.5.0rc4, <=0.6.1), artifact-ddd (>=0.0.1, <=0.0.3) +144 more potentially affected by CVE-2026-26007 via cryptography (>=46.0.0, <=46.0.4)

cryptography PYPI version =46.0.0, =0.5.0rc4, =0.0.1, =0.13.12, =3.8.9, =0.2.50, =0.7.0, =3.0.0a1, =0.4.6, =1.1.56, =1.0.3, =4.7.0, =1.28.0rc1, =1.29.0 and more Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

biweeklybudget (>=0.1.0, <=0.7.0), crossbar (17.3.1) +6 more potentially affected by CVE-2026-26007 via cryptography (1.8.1)

cryptography PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - biweeklybudget =0.1.0, =1.6.0, =1.1.2, =2.2.0, =0.3.4, =0.3.5 - typtop 0.2.11 Source cves: CVE-2026-26007 Source advisory:...

askflow-cli (1.0.0), atlassian-jwt-auth (>=8.0.2, <=9.0.0) +68 more potentially affected by CVE-2026-26007 via cryptography (3.2.1)

cryptography PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - askflow-cli 1.0.0 - atlassian-jwt-auth =8.0.2, =0.0.9, =0.2.7a0, =0.0.2, =0.0.1a12, =0.6.0, =3.1.12, =2.1.0, =1.0.0, =0.0.19, =0.7.1,...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-26007 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: incert, rancher-system-agent, gitness, tfsec, custom-pod-autoscaler, crossplane-provider-aws-iam, fscrypt, sftpgo-plugin-eventstore, docker-cli, gitaly, zot, certificate-transparency, grpcurl, nri-haproxy, juicefs-csi-driver, k9s, iptables-wrappers, k8sgpt,...