CVE-2026-13748: Improper Limitation of a Pathname to a Restricted Directory

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

CVE-2026-13749: Improper Control of Generation of Code

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generate...

aioambient (>=1.1.0, <=1.1.1), convo-nlu (0.1.0) +12 more potentially affected by CVE-2026-48804 via python-socketio (4.5.1)

python-socketio PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-socketio and may be impacted: - aioambient =1.1.0, =2020.1.0b2, =1.10.0a2, =0.1.0, =0.1.0, =0.1.2, =1.0.0, =9.0.6, =9.2.0 Source cves: CVE-2026-48804 Source...

galileo-cli (>=0.0.11, <=0.0.15), galileo-sdk (>=0.0.18, <=1.0.1) +2 more potentially affected by CVE-2026-48804 via python-socketio (4.3.1)

python-socketio PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-socketio and may be impacted: - galileo-cli =0.0.11, =0.0.18, =3.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-48804 Source advisory: OSV:GHSA-5W7Q-77MV-V69F...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: buildah-fips, falco-no-driver, kaf, fscrypt, knative-serving, argo-workflows-fips, packer-fips, grafana-fips, knative-serving-fips, etcd-fips, aactl, omnictl-multiarch, frankenphp-8.4, kubernetes-dashboard, prometheus-fips, keda-fips, teleport-operator-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: loki, falco-no-driver, kaf, fscrypt, flux-image-automation-controller, knative-serving, argo-workflows-fips, coder, grafana-fips, knative-serving-fips, minio-fips, etcd-fips, aactl, omnictl-multiarch, skaffold-fips, flux-fips, frankenphp-8.4, kubernetes-dashboard,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: buildah-fips, kaf, docker-fips, argo-workflows-fips, go-discover-fips, gitlab-pages, crossplane-provider-aws-emr, crossplane-provider-aws-sagemaker-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-powerbidedicated, openbao, datadog-agent-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: buildah-fips, kaf, docker-fips, argo-workflows-fips, go-discover-fips, gitlab-pages, crossplane-provider-aws-emr, crossplane-provider-aws-sagemaker-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-powerbidedicated, openbao, datadog-agent-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: loki, falco-no-driver, rootlesskit, kaf, nfpm, fscrypt, gomplate-fips, flux-image-automation-controller, gatus, knative-serving, docker-fips, argo-workflows-fips, packer-fips, coder, grafana-fips, pulumi-language-dotnet, knative-serving-fips, minio-fips, etcd-fips,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: cloud-provider-aws, mattermost, opentelemetry-collector, spire-server, zarf, argocd-image-updater, containerd, helm, flux-source-controller, flux-image-automation-controller, cilium-cli, trivy-operator, osv-scanner, external-dns, gitlab-kas, loki, rancher-agent, zot,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: zarf, crossplane-provider-azure-sql, gatus, flux-source-controller, tekton-chains, fulcio, docker-cli-buildx, flux-image-automation-controller, trivy-operator, osv-scanner, external-dns, loki, crossplane-provider-azure-authorization, prometheus-operator, kots,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: cloud-provider-aws, mattermost, opentelemetry-collector, spire-server, buildah, containerd, helm, docker-cli-buildx, cilium-cli, external-dns, gitlab-kas, loki, rancher-agent, zot, kine, kots, prometheus-operator, minio, kubernetes-dashboard, nerdctl, kyverno, podman...

GO-2026-5656 Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users in github.com/kubetail-org/kubetail/modules/cli. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go...

GO-2026-5335 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection in github.com/cli/cli

GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection in github.com/cli/cli...

GO-2026-5271 GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands in github.com/cli/cli

GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands in github.com/cli/cli...

Malicious code in stitch-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81a0c5de3abe7924f58304e27e1537821c217c9348c060b31c5424407f9f10cc The npm package ships a preinstall lifecycle hook scripts/preinstall.js that, on npm install, reads classic installer-secret paths — /.gitconfig,...

Malicious code in leo-cli (npm)

The leo-cli npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6421 Malicious code in leo-cli (npm)

The leo-cli npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to a variant of the "Miasma" supply chain attack targeting the LeoPlatform npm ecosystem. A malicious actor compromised a legitimate maintainer account and used it to publish infected versions of this...

CVE-2026-48721

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable00 until 0.2026.05.06.15.42.stable01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety...