Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the configserver process. An attacker can access and modify sensitive configuration and secret data by sending cross-origin GraphQL requests to the local development server without...

GHSA-W2Q5-6Q6X-X959 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, grafana-mimir, crossplane-provider-aws-sfn, doppler-kubernetes-operator, crossplane-provider-aws-osis, crossplane-provider-aws-pinpoint-fips, longhorn-engine, drone-fips, crossplane-provider-aws-rolesanywhere, src-fingerprint-fips,...

kaithem (0.95.0), pantra (>=1.4.10, <=1.5.1) +3 more potentially affected by CVE-2026-48710 via starlette (0.51.0)

starlette PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - kaithem 0.95.0 - pantra =1.4.10, =0.1.26, =0.2.0, =0.2.2 - telepact-cli 1.0.0a177 Source cves: CVE-2026-48710 Source advisory:...

CVE-2026-20245: Improper Encoding or Escaping of Output

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplyi...

amdshark-ai (3.9.0), amdsharktank (3.9.0) +11 more potentially affected by CVE-2026-5241 via transformers (4.52.1)

transformers PYPI version 4.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - amdshark-ai 3.9.0 - amdsharktank 3.9.0 - dora-qwen =0.3.12rc0, =0.1.3, =1.0.0, =0.0.9, =3.6.0, =3.6.0, =0.1.3, =0.0.2, =2.0.0, =2.0.1...

Linux Distros Unpatched Vulnerability : CVE-2026-48501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitHub CLI gh is GitHub's official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: nerdctl, grafana-pyroscope, kots, external-secrets-operator, minio, caddy, prometheus, ingress-nginx-controller, gitea, snyk-cli, kine, vale, prometheus-operator, hydra, glab, falco-no-driver, k3s, crossplane-provider-azure-storage, kubernetes-dashboard, zot, step,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: nerdctl, grafana-pyroscope, kots, external-secrets-operator, minio, caddy, prometheus, ingress-nginx-controller, gitea, snyk-cli, kine, vale, prometheus-operator, hydra, glab, falco-no-driver, k3s, crossplane-provider-azure-storage, kubernetes-dashboard, zot, step,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: nerdctl, grafana-pyroscope, kots, external-secrets-operator, minio, caddy, prometheus, ingress-nginx-controller, gitea, snyk-cli, kine, vale, prometheus-operator, hydra, glab, falco-no-driver, k3s, crossplane-provider-azure-storage, kubernetes-dashboard, zot, step,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: nerdctl, grafana-pyroscope, kots, external-secrets-operator, minio, caddy, prometheus, ingress-nginx-controller, gitea, snyk-cli, kine, vale, prometheus-operator, hydra, glab, falco-no-driver, k3s, crossplane-provider-azure-storage, kubernetes-dashboard, zot, step,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: nerdctl, grafana-pyroscope, kots, external-secrets-operator, minio, caddy, prometheus, ingress-nginx-controller, gitea, snyk-cli, kine, vale, prometheus-operator, hydra, glab, falco-no-driver, k3s, crossplane-provider-azure-storage, kubernetes-dashboard, zot, step,...

CVE-2026-49134

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell...

cli-pipeline (1.5.114), medikit (0.5.20) potentially affected by CVE-2026-8643 via pip (10.0.0b2)

pip PYPI version 10.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cli-pipeline 1.5.114 - medikit 0.5.20 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

hyperpod-elastic-agent (>=1.1.0, <=1.1.3), jupyter-quant (>=2509.1.0, <=2510.1.0) +5 more potentially affected by CVE-2026-8643 via pip (25.2.0)

pip PYPI version 25.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - hyperpod-elastic-agent =1.1.0, =2509.1.0, =0.1.0, =0.20.0, =3.13.0, =3.13.0, =3.14.0 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

cli-pipeline (1.5.114), medikit (0.5.20) potentially affected by CVE-2026-8643 via pip (10.0.0b2)

pip PYPI version 10.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cli-pipeline 1.5.114 - medikit 0.5.20 Source cves: CVE-2026-8643 Source advisory: OSV:PYSEC-2026-196...

Malicious Package

Overview xarc-webpack-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@agenticmail/api (>=0.6.0, <=0.7.21), @agenticmail/claudecode (>=0.1.0, <=0.1.17) +1 more potentially affected by CVE-2026-50287 via @agenticmail/mcp (>=0.6.2, <=0.7.9)

@agenticmail/mcp NPM version =0.6.2, =0.6.0, =0.1.0, =0.6.0, =0.8.36 Source cves: CVE-2026-50287 Source advisory: SNYK:JS-AGENTICMAILMCP-17751067...

MAL-2026-5105 Malicious code in @tmecontinue/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91dc0ad891441e786e37b86bbf8e4f881519bcfd68db3525c1a38f2064dbbbfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-MV8X-FG99-32MF hermes-agent has an Injection issue

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function sanitizeenvlines of the file hermescli/config.py. The manipulation results in injection. It is possible to launch the attack remotely. The attack requires a high level of...