GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: buildkitd, pulumi-language-dotnet, rekor, cerbos, zarf, docker-cli-buildx, karpenter, grafana-alloy, glab, argo-cd, containerd, libnvidia-container, traefik, scorecard, docker, dataplaneapi, telegraf, apko, kyverno, istio, trino, dask-gateway, pinact,...

CVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of...

CVE-2026-0286

Summary: CVE-2026-0286 is a command-injection vulnerability in the PAN-OS management plane. An authenticated administrator can execute arbitrary OS commands as root, via the CLI. The flaw affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prism...

Code injection in `saved_model_cli` in TensorFlow

ImpactTensorFlow's savedmodelcli tool is vulnerable to a code injection:savedmodelcli run --inputexprs 'x=print"malicious code to run"' --dir ./--tagset serve --signaturedef servingdefaultThis can be used to open a reverse shell savedmodelcli run --inputexprs 'hello=exec"""\nimport...

Code injection in `saved_model_cli` in TensorFlow

ImpactTensorFlow's savedmodelcli tool is vulnerable to a code injection:savedmodelcli run --inputexprs 'x=print"malicious code to run"' --dir ./--tagset serve --signaturedef servingdefaultThis can be used to open a reverse shell savedmodelcli run --inputexprs 'hello=exec"""\nimport...

PYSEC-2026-3289 Code injection in `saved_model_cli` in TensorFlow

Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection: savedmodelcli run --inputexprs 'x=print"malicious code to run"' --dir ./ --tagset serve --signaturedef servingdefault This can be used to open a reverse shell savedmodelcli run --inputexprs 'hello=exec"""\nimport...

PYSEC-2026-3125 Code injection in `saved_model_cli` in TensorFlow

Impact TensorFlow's savedmodelcli tool is vulnerable to a code injection: savedmodelcli run --inputexprs 'x=print"malicious code to run"' --dir ./ --tagset serve --signaturedef servingdefault This can be used to open a reverse shell savedmodelcli run --inputexprs 'hello=exec"""\nimport...

acuity (6.18.0), acuitylite (>=6.6.0, <=6.21.0) +60 more potentially affected by CVE-2022-29205 via tensorflow (2.8.0)

tensorflow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - acuity 6.18.0 - acuitylite =6.6.0, =1.2.8, =1.0.43, =0.2.2, =0.0.1, =0.0.2, =0.2.8, =0.14.0, =0.1.3, =0.0.9, =0.2.27, =0.2.41 -...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-29200 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-29200 Source advisory: OSV:PYSEC-2026-3089...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-29197 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-29197 Source advisory: OSV:PYSEC-2026-3202...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-29193 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-29193 Source advisory: OSV:PYSEC-2026-3087...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-23579 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-23579 Source advisory: OSV:PYSEC-2026-3108...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-23572 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-23572 Source advisory: OSV:PYSEC-2026-3241...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-23586 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-23586 Source advisory: OSV:PYSEC-2026-3096...

animalai-train (>=0.6.0, <=1.0.3), coach-cli (0.91.0) +3 more potentially affected by CVE-2022-23588 via tensorflow (1.12.2)

tensorflow PYPI version 1.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - animalai-train =0.6.0, =0.10.0, =0.3.2, =0.4.3 Source cves: CVE-2022-23588 Source advisory: OSV:PYSEC-2026-3181...

deepomatic-cli (>=0.6.1, <=0.7.2), kuto (0.0.43) +2 more potentially affected by CVE-2019-5064 via opencv-python-headless (3.4.18.65)

opencv-python-headless PYPI version 3.4.18.65 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python-headless and may be impacted: - deepomatic-cli =0.6.1, =1.0.38, =1.0.44 Source cves: CVE-2019-5064 Source advisory: OSV:PYSEC-2026-2841...

deepomatic-cli (>=0.6.1, <=0.7.2), kuto (0.0.43) +2 more potentially affected by CVE-2019-16249 via opencv-python-headless (3.4.18.65)

opencv-python-headless PYPI version 3.4.18.65 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python-headless and may be impacted: - deepomatic-cli =0.6.1, =1.0.38, =1.0.44 Source cves: CVE-2019-16249 Source advisory: OSV:PYSEC-2026-2842...

deepomatic-cli (>=0.6.1, <=0.7.2), kuto (0.0.43) +2 more potentially affected by CVE-2019-14493 via opencv-python-headless (3.4.18.65)

opencv-python-headless PYPI version 3.4.18.65 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python-headless and may be impacted: - deepomatic-cli =0.6.1, =1.0.38, =1.0.44 Source cves: CVE-2019-14493 Source advisory: OSV:PYSEC-2026-2834...

io.micronaut.security:micronaut-security-oauth2 (>=2.4.0, <=2.4.3), io.micronaut.starter:micronaut-micronaut-cli (2.4.0) +4 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.4.0)

io.micronaut:micronaut-http-client MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.security:micronaut-security-oauth2 =2.4.0, =2.4.3 -...

io.micronaut.starter:micronaut-micronaut-cli (2.2.1), io.micronaut.starter:micronaut-starter-api (2.2.1) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.2.1)

io.micronaut:micronaut-http-client MAVEN version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.starter:micronaut-micronaut-cli 2.2.1 -...