CVE-2026-87798

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary...

CVE-2026-86334 CLI Path Traversal via Content-Disposition in LXD Image Export/Copy

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

CVE-2026-86334

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

CVE-2026-84651

A flaw was found in Jenkins. The system's application programming interface API and command-line interface CLI for managing agent configurations fail to properly validate the target agent. This vulnerability allows an attacker, who already has permissions to configure one agent, to overwrite the...

CVE-2026-87969: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input...

CVE-2026-86334: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

Exploit for Path Traversal in Jenkins

\ CVE-2024-23897 — Jenkins CLI Arbitrary File Read Lab \ 1...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-100722 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

[SECURITY] Fedora 43 Update: goose-1.45.0-1.fc43

Goose is your on-machine AI agent, capable of automating complex development tasks from start to finish. More than just code suggestions, goose can build entire projects from scratch, write and execute code, debug failures, orchestrate workflows, and interact with external APIs - autonomously...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: helm-push, neuvector-scanner, tigera-operator, wolfictl, rancher, spegel, dagger, skaffold, headlamp, scorecard, steampipe, grype, zot, helm-set-status, k8sgpt, gatekeeper, trivy-operator, docker-cli-buildx, k9s, nerdctl, manifest-tool, k3s, kubevela, kargo,...

CVE-2026-100620

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100620 Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100620 Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100620 Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100620

The Capgo CLI (npm package @capgo/cli ) through version 7.98.2 is affected by an over-permissioned service account during the Android onboarding flow. When users onboard via Google OAuth , the CLI incorrectly requests the account-wide CAN_MANAGE_DRAFT_APPS_GLOBAL permission via the Android Publis...

EUVD-2026-87715

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

CVE-2026-100577 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

EUVD-2026-87474

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100620: Improper Privilege Management

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

PT-2026-99291

Name of the Vulnerable Software and Affected Versions Capgo CLI versions prior to 7.98.3 Description The Android onboarding flow contains an over-permissioned service account. During Google OAuth onboarding, the CLI assigns the CAN MANAGE DRAFT APPS GLOBAL permission passed via the...