EUVD-2026-83182

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-63406

AnyCable versions prior to 1.6.15 contain a confidentiality issue in its telemetry subsystem. The file telemetry/config.go embeds a hardcoded public authToken ("secret") used to authenticate to telemetry.anycable.io, while clusterFingerprint() in telemetry/telemetry.go incorporates raw CLI argume...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CLEANSTART-2026-MK81849 Security fix for CVE-2025-66406 applied in: step 0.28.7-r2, step-cli 0.27.5-r1, step-issuer-fips 0.9.11-r1

CVE-2025-66406 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZR04706 Security fix for CVE-2025-44005 applied in: step-cli 0.27.5-r1, step-issuer-fips 0.9.11-r1

CVE-2025-44005 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TM64574 Security fix for CVE-2026-30836 applied in: step 0.28.7-r3, step 0.29.0-r2, step-cli 0.27.5-r1, step-issuer 0.10.0-r0, step-issuer 0.10.1-r0, step-issuer 0.10.2-r0, step-issuer 0.9.11-r1

CVE-2026-30836 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UT95390 Security fix for CVE-2026-41080 applied in: aws-cli 2.35.9-r2, ingress-nginx-controller 1.14.5-r2

CVE-2026-41080 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-81669: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges...

CVE-2026-58197: Improper Access Control

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection due to the hook editor handling in cmd/uniget/hooks.go. An attacker can execute arbitrary commands by setting EDITOR or UNIGETEDITOR to a value containing shell metacharacters and then invoking the hook...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92941 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92941 Source advisory: SNYK:JS-VM2-20043907...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92935 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92935 Source advisory: SNYK:JS-VM2-20043635...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92938 via vm2 (>=3.11.3, <=3.11.6)

vm2 NPM version =3.11.3, =3.0.57, =0.1.0, =2.32.0, =1.0.0, =1.1.0, =0.2.0, =2.32.0, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.72.4, =1.74.12 and more Source cves: CVE-2026-92938 Source advisory: SNYK:JS-VM2-20043637...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92947 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92950 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

Insecure Defaults

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Insecure Defaults via the require process in the CLI tool. An attacker can execute arbitrary code in the host environment by supplying a malicious...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92955 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

GHSA-657C-G7QC-R9J2 Redocly CLI: Path traversal when using `split` command

Impact An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sampl...