GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: bank-vaults, prometheus-operator-fips, thanos-receive-controller-fips, knative-operator-fips, aws-load-balancer-controller, terraform-provider-azapi-fips, helm-fips, kubernetes-csi-livenessprobe, custom-pod-autoscaler-fips, kubernetes-replicator-fips, influxd,...

CVE-2026-5059 aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

tekton-cli-0.44.1-1.1 on GA media (moderate)

tekton-cli-0.44.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10529-1 Rating: moderate Cross-References: CVE-2026-33211 CVE-2026-34986 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issues fixed in the...

GHSA-68QG-G8MG-6PR7 paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

Summary An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. No user interaction, no credentials, just the target's address. The entire chain is six API calls. I verified every ste...

@godmode-team/godmode (=1.6.1), companies.sh (>=2026.324.0-canary.0 <=2026.325.0-canary.3) +1 more potentially affected by CVE-2026-41679 via paperclipai (>=0.3.1 <=2026.324.0-canary.7)

paperclipai NPM version =0.3.1, =2026.324.0-canary.0, =2026.325.0-canary.3 - stacy-cli =0.3.1 Source cves: CVE-2026-41679 Source advisory: OSV:GHSA-68QG-G8MG-6PR7...

@saltcorn/cli (>=1.5.0 <=1.5.0-rc.2), @saltcorn/mobile-builder (>=1.5.0 <=1.5.0-rc.2) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0 <=1.5.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.0-rc.2 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.6.0-alpha.0 <=1.6.0-beta.14), @saltcorn/base-plugin (>=1.6.0-alpha.0 <=1.6.0-beta.14) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.6.0-alpha.0 <=1.6.0-beta.3)

@saltcorn/data NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.14 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-alpha.17), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-alpha.17) potentially affected by unknown CVE via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-alpha.9)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.17 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@christianhugo/mobile-builder (>=0.7.3-beta.3 <=0.7.4-beta.9), @christianhugoch/cli (>=0.7.2-beta.12 <=0.7.2-beta.13) +4 more potentially affected by CVE-2026-40163 via @saltcorn/server (>=0.0.2 <=1.4.4)

@saltcorn/server NPM version =0.0.2, =0.7.3-beta.3, =0.7.2-beta.12, =0.0.2, =0.7.2, =0.0.2, =0.2.3-beta.2 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.6.0-alpha.0 <=1.6.0-beta.14), @saltcorn/mobile-builder (>=1.6.0-alpha.0 <=1.6.0-beta.14) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0 <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.14 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.0.0 <=1.4.4), @saltcorn/mobile-builder (>=1.0.0 <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1 <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0, =1.0.0, =1.4.4 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.5.0 <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0 <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0 <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0 <=1.5.2), @saltcorn/mobile-builder (>=1.5.0 <=1.5.2) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0 <=1.5.2)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0, =1.5.0, =1.5.2 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

CVE-2026-35659

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious...

CVE-2026-35659 OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious...

@cedarjs/api-server (>=1.0.0-canary.12863 <=9.0.0-canary.1784), @cedarjs/cli (>=1.0.0-canary.12863 <=9.0.0-canary.1784) +12 more potentially affected by CVE-2026-23869 via react-server-dom-webpack (>=19.2.1 <=19.2.4)

react-server-dom-webpack NPM version =19.2.1, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

EUVD-2026-21196

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information. A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive...

PT-2026-31970

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious...

OPENSUSE-SU-2026:10529-1 tekton-cli-0.44.1-1.1 on GA media

These are all security issues fixed in the tekton-cli-0.44.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-33791

An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system. Certain 'set...