PT-2026-22939

Name of the Vulnerable Software and Affected Versions Docker CLI versions through 29.1.5 Docker Compose versions 2.31.0 through 5.0.0 Description The Docker CLI for Windows searches for plugin binaries in C:ProgramDataDockercli-plugins, a directory that does not exist by default. An attacker with...

PT-2026-23022

A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as root. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This...

GHSA-XC68-RRQC-QGQ3 MCP NMAP Server has an Injection vulnerability

A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function childprocess.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may...

CVE-2026-3484

A vulnerability was detected in PhialsBasement nmap-mcp-server up to bee6d23547d57ae02460022f7c78ac0893092e38. Affected by this issue is the function childprocess.exec of the file src/index.ts of the component Nmap CLI Command Handler. The manipulation results in command injection. The attack may...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kubescape-server-fips, docker-compose-fips, cluster-api-provider-vsphere, k8sgpt, temporal-server, velero, tkn, kyverno-policy-reporter-plugins-kyverno-fips, witness, keda, terragrunt, cloudprober-fips, jaeger-operator-fips, eck-operator-fips,...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the clihistory feature. An attacker can access sensitive command history and API request/response data by reading the history database file if it is created with default permissions on a multi-user Unix...

GO-2026-4556 Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api

Vikunja has Path Traversal in CLI Restore in code.vikunja.io/api...

digger-cli-0.6.143-1.1 on GA media (moderate)

digger-cli-0.6.143-1.1 on GA media Announcement ID: openSUSE-SU-2026:10260-1 Rating: moderate Cross-References: CVE-2025-61729 CVSS scores: CVE-2025-61729 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61729 SUSE : 8.7...

CVE-2026-20037

A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files and perform unauthorized actions on an affected system. This vulnerability exists because unnecessary privileges are given to the...

CVE-2026-20107

A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. To exploit this vulnerability, the attacker...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: q, flux-kustomize-controller, cilium-cli, crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, flux-source-controller, snyk-cli, aactl, crossplane-provider-aws-lambda, argo-events, docker-cli-buildx, buildkitd, trivy-operator, opentofu, extism,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: q, flux-kustomize-controller, cilium-cli, crossplane-provider-aws-sns, crossplane-provider-aws-cloudformation, flux-source-controller, snyk-cli, aactl, crossplane-provider-aws-lambda, argo-events, docker-cli-buildx, buildkitd, trivy-operator, opentofu, extism,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: k9s-fips, kubescape-server-fips, crossplane-provider-aws-s3, cloudbeat, crossplane-provider-aws-lambda, terraform-provider-azuread-fips, crossplane-provider-aws-cognitoidentity-fips, kyverno-policy-reporter-plugins-kyverno-fips, crossplane-provider-aws-efs-fips,...

Vikunja has Path Traversal in CLI Restore

Summary Path Traversal Zip Slip and Denial of Service DoS vulnerability discovered in the Vikunja CLI's restore functionality. Details The restoreConfig function in vikunja/pkg/modules/dump/restore.go of the https://github.com/go-vikunja/vikunja/tree/main repository fails to sanitize file paths...

GHSA-42WG-38GX-85RH Vikunja has Path Traversal in CLI Restore

Summary Path Traversal Zip Slip and Denial of Service DoS vulnerability discovered in the Vikunja CLI's restore functionality. Details The restoreConfig function in vikunja/pkg/modules/dump/restore.go of the https://github.com/go-vikunja/vikunja/tree/main repository fails to sanitize file paths...

mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

In mcp-server-git versions prior to 2026.1.14, the gitadd tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's repo.index.add, which did not enforce working-tree boundary checks for relative paths. As a result,...

GHSA-VJQX-CFC4-9H6V mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

In mcp-server-git versions prior to 2026.1.14, the gitadd tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's repo.index.add, which did not enforce working-tree boundary checks for relative paths. As a result,...

BIT-AIRFLOW-2025-27555 Apache Airflow: Connection Secrets not masked in UI when Connection are added via Airflow cli

Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were...

OPENSUSE-SU-2026:10260-1 digger-cli-0.6.143-1.1 on GA media

These are all security issues fixed in the digger-cli-0.6.143-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-27819 Vikunja has Path Traversal in CLI Restore

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...