11454 matches found
GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
...
GitHub CLI: Partial token disclosure in `gh auth status` output
...
GitHub CLI: Unescaped variable components in request URLs could allow path traversal
...
[SECURITY] Fedora 43 Update: xen-4.20.4-1.fc43
This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...
CVE-2026-48790: Incorrect Default Permissions
Turso CLI is the command line interface CLI to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any othe...
PT-2026-76419
These are all security issues fixed in the buildpacks-cli-0.40.9-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-70907
Name of the Vulnerable Software and Affected Versions GMS Command-Line Interface CLI versions prior to 9.5.1 Build 9510.1044 Description An authenticated command injection issue exists in the GMS Virtual Appliance interface. This flaw allows a low-privileged local user to execute system commands...
CVE-2026-73222: Improper Neutralization of Special Elements used in an OS Command
Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The...
CVE-2026-66149: Improper Control of Generation of Code
Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...
CVE-2026-66148: Improper Control of Generation of Code
An authenticated command injection vulnerability was identified in GMS Command-Line Interface CLI 9.5.1 Build 9510.1044 and earlier versions which allows low-privileged local user to execute system commands with root privileges...
CVE-2026-73245: Missing Authentication for Critical Function
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...
PT-2026-70908
Name of the Vulnerable Software and Affected Versions SonicWall Email Security affected versions not specified Description An authenticated attacker with access to the restricted CLI can perform a local privilege escalation by injecting arbitrary OS commands that execute with root privileges. Thi...
OPENSUSE-SU-2026:11493-1 buildpacks-cli-0.40.9-1.1 on GA media
These are all security issues fixed in the buildpacks-cli-0.40.9-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...
CVE-2026-72718 goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...
CVE-2026-64654
A flaw was found in GitHub CLI gh. Multiple commands within the tool fail to neutralize terminal escape sequences when displaying externally controlled content. An attacker who can influence this content can embed malicious escape sequences. These sequences are then interpreted by a user's...
CVE-2026-64653
A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...
PT-2026-76462
Summary The AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...
PT-2026-69293
Name of the Vulnerable Software and Affected Versions mifi lossless-cut versions prior to 3.69.1 Description A server-side request forgery issue exists within the Built-in HTTP API Service component, specifically in the src/main/httpServer.ts file. This flaw allows an attacker with local network...
