CVE-2026-84452

Windows ML CLI (a command-line tool for building AI models for Windows) is vulnerable to arbitrary code execution via a CORS misconfiguration on its localhost HTTP API. Prior to version 0.4.0 , the cli_api.py and app.py components expose WinML CLI commands on localhost without authentication and ...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

GO-2026-6317 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

EUVD-2026-70123

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84657

In Jenkins version 2.579 and earlier (including LTS 2.568.2 and earlier ), the build CLI command fails to verify the Item/Cancel permission when utilizing the -s flag to cancel a build triggered to wait for completion. This flaw allows an attacker with Item/Build permissions to cancel builds init...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62680 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-62680 Source advisory: OSV:GHSA-CXQ5-97V7-87J8...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-72716 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-72716 Source advisory: OSV:GHSA-P4CG-3328-RVFG...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71866 via orval (>=8.5.3, <=8.14.0)

orval NPM version =8.5.3, =0.6.3, =0.7.3 Source cves: CVE-2026-71866 Source advisory: OSV:GHSA-6MR6-JVCR-2F25...

GHSA-CVHV-G4RQ-3HMW ImageMagick: Memory Leak when providing invalid options to the cli

A memory leak is possible when invalid options are passed to the cli magick...

ImageMagick: Memory Leak when providing invalid options to the cli

A memory leak is possible when invalid options are passed to the cli magick...

Malicious Package

Overview vitest-cli-pro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...