Malicious code in common-cli-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4c7bdeaa334d938afac649a1c3195ff47bf6fef18168e78b61ad22c6252450 The package common-cli-utils was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2026-0022

Malicious code in common-cli-utils npm...

MAL-2026-2 Malicious code in common-cli-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4c7bdeaa334d938afac649a1c3195ff47bf6fef18168e78b61ad22c6252450 The package common-cli-utils was found to contain malicious code. Source: ossf-package-analysis...

elemeno-ai-sdk (>=0.0.5, <=0.6.11), elemeno-mlops-cli (>=0.0.1, <=0.0.4) +22 more potentially affected by CVE-2025-11157 via feast (>=0.9.3, <=0.49.0)

feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.3.0, =0.1.0rc3, =0.0.2, =1.0.0, =0.1.0, =0.1.33.dev3, =0.1.0, =0.6.19 and more Source cves: CVE-2025-11157 Source advisory: GHSA-34WM-4HW7-QFJV...

Insufficiently Protected Credentials

Overview rdsai-cli is an AI-powered CLI tool for Relation database management and analysis Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to insecure local storage of sensitive credentials. An attacker can exploit this by accessing the configuration...

CVE-2025-1977

The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability CVE-2025-1977 that allows an authenticated user with read-only access to perform unauthorized configuration changes through the MCC Moxa CLI Configuration tool. The issue can be exploited remote...

CVE-2025-1977

The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability CVE-2025-1977 that allows an authenticated user with read-only access to perform unauthorized configuration changes through the MCC Moxa CLI Configuration tool. The issue can be exploited remote...

CVE-2025-1977: Execution with Unnecessary Privileges

The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability CVE-2025-1977 that allows an authenticated user with read-only access to perform unauthorized configuration changes through the MCC Moxa CLI Configuration tool. The issue can be exploited remote...

Exploit for CVE-2025-59532

CVE-2025-59532 Docker Environment A Docker-based research env...

CVE-2018-25145

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/mcli/', and '/tmp' to access syst...

amdshark-ai (3.9.0), amdsharktank (3.9.0) +11 more potentially affected by CVE-2025-14929 via transformers (4.52.1)

transformers PYPI version 4.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - amdshark-ai 3.9.0 - amdsharktank 3.9.0 - dora-qwen =0.3.12rc0, =0.1.3, =1.0.0, =0.0.9, =3.6.0, =3.6.0, =0.1.3, =0.0.2, =2.0.0, =2.0.1...

biomni-bridge (>=0.3.1, <=0.3.3), dataflex (1.0.0) +8 more potentially affected by CVE-2025-14929 via transformers (4.54.1)

transformers PYPI version 4.54.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - biomni-bridge =0.3.1, =0.0.1, =0.1.0, =0.2.0, =1.18.1, =0.1.0, =1.10.0, =1.10.1 - zensols-propbankdb 0.2.1 Source cves: CVE-2025-14929...

bacpipe (>=1.1.0, <=1.3.0), certora-patrol (>=0.1.3, <=0.1.17) +9 more potentially affected by CVE-2025-14929 via transformers (4.56.0)

transformers PYPI version 4.56.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - bacpipe =1.1.0, =0.1.3, =0.1.18, =0.2.1a0, =0.3.2, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2025-14929 Source advisory: OSV:PYSEC-2025-2...

homeassistant-cli (0.2.0) potentially affected by CVE-2025-65713 via homeassistant (0.83.3)

homeassistant PYPI version 0.83.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-cli 0.2.0 Source cves: CVE-2025-65713 Source advisory: OSV:GHSA-PP3G-XMM4-5CW9...

Malicious code in chalk-cli (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-192896 Malicious code in chalk-cli (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-26787: External Control of Critical State Data

An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initial startup of the container sets a property of "allowany" to allow any user with a valid and trusted client auth...

CVE-2025-26787

Keyfactor SignServer versions prior to 7.2 are vulnerable to a logic error in the container startup process. The Admin CLI command , intended to set a default "allowany" property only during the initial startup, incorrectly executes on every container restart. This causes the system to reset conf...

CVE-2025-65637 affecting package cf-cli for versions less than 8.4.0-26

CVE-2025-65637 affecting package cf-cli for versions less than 8.4.0-26. A patched version of the package is available...

Malicious Package

Overview adk-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...