CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-workflows, argo-workflows-fips, crossplane-fips, livekit-cli, syft, kubevela, guac, pulumi-language-java, k9s-fips, grype-fips, kubevela-fips, chezmoi, gitsign, kubescape-server, kubescape-server-fips, tfsec, k9s, skaffold, src-fingerprint-fips, trufflehog,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: argo-workflows, argo-workflows-fips, crossplane-fips, livekit-cli, syft, kubevela, guac, pulumi-language-java, k9s-fips, grype-fips, kubevela-fips, chezmoi, gitsign, kubescape-server, kubescape-server-fips, tfsec, k9s, skaffold, src-fingerprint-fips, trufflehog,...

GHSA-J3Q9-MXJG-W52F vulnerabilities

Vulnerabilities for packages: vitess, gemini-cli, redisinsight, code-server, langfuse-fips, kibana, saf, wazuh-dashboard, tileserver-gl-fips, opensearch-dashboards-fips, tileserver-gl, opensearch-dashboards, langfuse, thingsboard...

CVE-2026-4926 vulnerabilities

Vulnerabilities for packages: vitess, gemini-cli, redisinsight, code-server, langfuse-fips, kibana, saf, wazuh-dashboard, tileserver-gl-fips, opensearch-dashboards-fips, tileserver-gl, opensearch-dashboards, langfuse, thingsboard...

CVE-2026-4923 vulnerabilities

Vulnerabilities for packages: vitess, gemini-cli, redisinsight, code-server, langfuse-fips, kibana, saf, wazuh-dashboard, tileserver-gl-fips, opensearch-dashboards-fips, tileserver-gl, opensearch-dashboards, langfuse, thingsboard...

GHSA-27V5-C462-WPQ7 vulnerabilities

Vulnerabilities for packages: vitess, gemini-cli, redisinsight, code-server, langfuse-fips, kibana, saf, wazuh-dashboard, tileserver-gl-fips, opensearch-dashboards-fips, tileserver-gl, opensearch-dashboards, langfuse, thingsboard...

au.csiro.pathling:encoders (>=8.0.0 <=9.5.0), au.csiro.pathling:fhirpath (>=8.0.0 <=9.5.0) +164 more potentially affected by CVE-2026-34359 via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (>=6.4.1 <=6.9.3)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version =6.4.1, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0, =8.2.0, =8.2.0, =8.2.0, =8.2.0, =8.2.0, =8.2.0, =8.2.0, =8.2.0, =8.8.1 and more Source cves: CVE-2026-34359 Source advisory: SNYK:JAVA-CAUHNHAPIFHIR-15855257...

@tinacms/app (>=0.0.0-0a1049d-20260309051347 <=2.4.0), @tinacms/cli (>=0.0.0-0a1049d-20260309051347 <=2.2.0) +4 more potentially affected by CVE-2026-33949 via @tinacms/graphql (>=2.0.0 <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-0a1049d-20260309051347, =0.0.0-0a1049d-20260309051347, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0a1049d-20260309051347, =0.0.0-0a1049d-20260309051347, =3.7.0 Source cves: CVE-2026-33949 Source advisory: SNYK:JS-TINACMSGRAPHQL-15855320...

filecc (>=0.0.1 <=1.0.1), gm-i18n-migrate (>=2.7.0 <=2.9.0) +3 more potentially affected by unknown CVE via opencc (>=1.0.6 <=1.1.3)

opencc NPM version =1.0.6, =0.0.1, =2.7.0, =2.7.2, =1.0.2, =1.0.5 - wise-paas-notify-utility =1.4.10-s2t1 Source cves: unknown CVE Source advisory: OSV:GHSA-7FQQ-Q52P-2JJG...

CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it...

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Summary The Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI...

CVE-2026-33748 vulnerabilities

Vulnerabilities for packages: buildah, trivy, conftest, skaffold, guac, kubescape, podman, scorecard, osv-scanner, docker-compose, kaniko, zot, docker-cli-buildx, trivy-operator...

GHSA-4VRQ-3VRQ-G6GG vulnerabilities

Vulnerabilities for packages: buildah, trivy, conftest, skaffold, guac, kubescape, podman, scorecard, osv-scanner, docker-compose, kaniko, zot, docker-cli-buildx, trivy-operator...

GHSA-4C29-8RGM-JVJJ vulnerabilities

Vulnerabilities for packages: buildah, trivy, conftest, skaffold, guac, kubescape, podman, scorecard, osv-scanner, docker-compose, kaniko, zot, docker-cli-buildx, trivy-operator...

CVE-2026-33747 vulnerabilities

Vulnerabilities for packages: buildah, trivy, conftest, skaffold, guac, kubescape, podman, scorecard, osv-scanner, docker-compose, kaniko, zot, docker-cli-buildx, trivy-operator...

GHSA-4VRQ-3VRQ-G6GG vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, zot, cloudbeat, trivy-fips, conftest, livekit-cli, podman, scorecard, trivy-operator-fips, guac, kubescape, kaniko, docker-fips, skaffold-fips, docker-compose-fips, buildah-fips, trivy-operator, docker-compose, kubescape-server, docker-cli-buildx,...

CVE-2026-33748 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, zot, cloudbeat, trivy-fips, conftest, livekit-cli, podman, scorecard, trivy-operator-fips, guac, kubescape, kaniko, docker-fips, skaffold-fips, docker-compose-fips, buildah-fips, trivy-operator, docker-compose, kubescape-server, docker-cli-buildx,...

CVE-2026-33747 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, zot, cloudbeat, trivy-fips, conftest, livekit-cli, podman, scorecard, trivy-operator-fips, guac, kubescape, kaniko, docker-fips, skaffold-fips, docker-compose-fips, buildah-fips, trivy-operator, docker-compose, kubescape-server, docker-cli-buildx,...

PT-2026-28312

Name of the Vulnerable Software and Affected Versions Coverity Connect affected versions not specified Description The authentication logic in the command line tooling for Coverity Connect is missing an error handler, leading to a potential authentication bypass. An attacker with access to the...

External Control of Critical State Data

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of Critical State Data in the CLI routing process after failed service resolution, where Bonjour and DNS-SD TXT metadata could still influence the chosen target. An...