CVE-2026-57165 PJSIP: Pre-authentication overflow in the telnet CLI history

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall handleupdown in clitelnet.c. This affects only applications that enab...

CVE-2026-57165 PJSIP: Pre-authentication overflow in the telnet CLI history

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall handleupdown in clitelnet.c. This affects only applications that enab...

CVE-2026-57165

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in the PJLIB-UTIL telnet CLI front-end when redrawing the command line during history recall handleupdown in clitelnet.c. This affects only applications that enab...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass in the _validate_command_with_operators function. When ALLOW_SHELL_OPERATORS is enabled, an attacker can inject shell command substitution syntax such as $(...) or backticks to execute commands that are not on the ALLOWED_COMMANDS allowlist...

CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

EUVD-2026-71116

cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the validatecommandwithoperators function when ALLOWSHELLOPERATORS is enabled. Attackers can use shell command substitution syntax like $... or backticks to execute non-allowlisted commands that bypass the ALLOWEDCOMMANDS...

secator v0.43.3

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

kontext-cli v1.3.0

Website | Documentation | Dashboard | Discord Stop risky AI-agent actions before they run AI agents do more than suggest code. They run shell commands, read files, call services, change infrastructure, and interact with production systems. Kontext puts local policy between AI agents and the tools...

Malicious Package

Overview vitest-cli-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dbt-sa-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

cloudquery cli-v6.42.2

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

CVE-2025-71408

A flaw was found in NLTK Natural Language Toolkit. This eval injection vulnerability in the nltk.collocations module allows a local attacker to execute arbitrary Python code. By manipulating command-line arguments when collocations.py is invoked directly, an attacker can bypass validation and...

sonar v0.4.1

██████ ███ ██████ ██ ██████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██████ ███ ██ ██ ██ ██ ██ ██ Know what's running on your machine. Sonar shows everything listening on localhost and puts it in order: every port belongs to a group — normally th...

fence v0.1.67

Fence wraps commands in a sandbox that blocks network access by default and restricts filesystem operations based on configurable rules. It's most useful for running semi-trusted code package installs, build scripts, CI jobs, unfamiliar repos with controlled side effects, and it can also compleme...

Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

MAL-2026-15870 Malicious code in vitest-cli-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...

CVE-2026-56855 vulnerabilities

Vulnerabilities for packages: external-dns, flux-image-automation-controller-fips, terraform-fips, chezmoi, flux-source-controller-fips, trufflehog, dagger, gomplate-fips, docker-fips, bento-fips, chainctl-fips, mediamtx, trivy-operator, drone-fips, wolfictl, docker-cli-buildx, rancher-agent,...

codex-security npm-v0.1.25

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. Features Scan repositories, selected paths, or Git changes. Deep scans run parallel discovery workers on repositories and selected paths. Validate candidate...