@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.4) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.4)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-42259 Source advisory: SNYK:JS-SALTCORNSERVER-16111017...

agent-builder (>=0.0.2, <=0.1.7), agent-nexus-cli (>=0.1.0, <=0.1.31) +159 more potentially affected by CVE-2026-41488 via langchain-openai (>=1.0.0a4, <=1.1.12)

langchain-openai PYPI version =1.0.0a4, =0.0.2, =0.1.0, =0.9.1, =0.1.2, =1.1.0a20250502, =1.1.0a20250502, =1.1.0rc1, =1.1.0rc1, =1.1.0a20250502, =1.1.0a20250502, =1.1.0a20250502, =0.1.0, =0.1.2, =0.3.2, =1.4.0a20260123, =1.5.0a20260130 and more Source cves: CVE-2026-41488 Source advisory:...

GHSA-XFQJ-R5QW-8G4J Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

Summary Several API endpoints in authenticated mode have no authentication at all. They respond to completely unauthenticated requests with sensitive data or allow state-changing operations. No account, no session, no API key needed. Verified against the latest version. Discord: sagi03581 Steps t...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2026-41425 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2026-41425 Source advisory: OSV:GHSA-JJ8C-MMJ3-MMG...

EUVD-2026-23292

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-41314 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-41314 Source advisory: OSV:GHSA-X284-J5P8-9C5P...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-41312 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-41312 Source advisory: OSV:GHSA-7GW9-CF7V-778F...

GHSA-33QF-Q99X-WPM8 Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates

Impact Up to 1.0.0 of home-assitant-cli or hass-cli for short an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and...

Improper Neutralization of Special Elements Used in a Template Engine

Overview homeassistant-cli is a Command-line tool for Home Assistant. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the handling of user-supplied Jinja2 templates. An attacker can execute arbitrary code by convincing ...

CVE-2026-6442

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent...

CVE-2026-6442 Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent...

CVE-2026-6442

CVE-2026-6442 concerns Snowflake Cortex Code CLI prior to version 1.0.25, where improper validation of bash commands allows embedding crafted content to cause the CLI agent to execute arbitrary code outside the sandbox. The NVD/CVE records describe this as a local RCE risk with non-deterministic ...

Malicious code in gemini-cli-vscode-ide-companion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a98d87fa5f23a47c4b1ea2c0cecb3e88518985493c1b7f125299ecf8ee6dba1 The package gemini-cli-vscode-ide-companion was found to contain malicious code...

MAL-2026-2764 Malicious code in gemini-cli-vscode-ide-companion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a98d87fa5f23a47c4b1ea2c0cecb3e88518985493c1b7f125299ecf8ee6dba1 The package gemini-cli-vscode-ide-companion was found to contain malicious code...

CVE-2026-6442: Improper Validation of Syntactic Correctness of Input

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent...

PT-2026-33382

Name of the Vulnerable Software and Affected Versions home-assistant-cli versions prior to 1.0.0 Description The Home Assistant Command-line interface hass-cli used an unrestricted environment instead of a sandboxed one to handle Jinja2 templates. User-supplied input within these templates was...

PT-2026-35330

Summary Several API endpoints in authenticated mode have no authentication at all. They respond to completely unauthenticated requests with sensitive data or allow state-changing operations. No account, no session, no API key needed. Verified against the latest version. Discord: sagi03581 Steps t...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-41168 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-41168 Source advisory: OSV:GHSA-JJ6C-8H6C-HPPX...

CVE-2026-20161

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are on the local file syst...

CVE-2026-20136

CVE-2026-20136 affects Cisco Identity Services Engine (ISE) and ISE-PIC CLI. Root cause: insufficient input validation enabling crafted CLI input to trigger command injection and elevate privileges to root on the underlying OS. Impact: authenticated, local admin can gain root privileges. Exploita...