CVE-2025-20117 Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability

A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due t...

AZL-57347 CVE-2025-22869 affecting package cf-cli for versions less than 8.7.11-2

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

PT-2025-8733 · Cisco · Cisco Apic

Name of the Vulnerable Software and Affected Versions: Cisco APIC affected versions not specified Description: A vulnerability in the implementation of internal system processes could allow an authenticated, local attacker to access sensitive information on an affected device. The attacker must...

PT-2025-8732 · Cisco · Cisco Apic

Name of the Vulnerable Software and Affected Versions: Cisco APIC affected versions not specified Description: A vulnerability in the CLI could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. The attacker must...

GHSA-JM46-725R-HH9V vulnerabilities

Vulnerabilities for packages: python, aws-cli-v2...

GHSA-797F-63WG-8CHV vulnerabilities

Vulnerabilities for packages: python, aws-cli-v2...

GHSA-JM46-725R-HH9V vulnerabilities

Vulnerabilities for packages: python, aws-cli-v2...

AZL-57201 CVE-2025-27144 affecting package dcos-cli for versions less than 1.2.0-20

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

AZL-57102 CVE-2025-27144 affecting package dcos-cli for versions less than 1.2.0-17

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

CVE-2023-45288 affecting package cf-cli for versions less than 8.7.3-6

CVE-2023-45288 affecting package cf-cli for versions less than 8.7.3-6. A patched version of the package is available...

CVE-2023-45288 affecting package docker-cli for versions less than 25.0.7-1

CVE-2023-45288 affecting package docker-cli for versions less than 25.0.7-1. An upgraded version of the package is available that resolves this issue...

GHSA-Q4XQ-445G-G6CH vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-config-cli...

CVE-2024-4028 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, keycloak...

MAL-2025-1465 Malicious code in ing-open-banking-cli-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e671918afbc4f855be4bae3831f2a5b173f03949b1c9de394cf545a13027863e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the command-line interface (CLI) of the Fortinet FortiManager device management software allows a attacker to disclose confidential information.

The vulnerability of the command-line interface CLI of the Fortinet FortiManager device management software is related to the use of a hard-coded cryptographic key. Exploiting this vulnerability allows an attacker, operating remotely, to disclose confidential information...

CVE-2025-25204

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...

@javamodules/indexer (>=1.0.4, <=1.0.5), @resultify/rh-cli (>=1.0.0, <=1.3.2) potentially affected by CVE-2025-25290 via @octokit/request (>=9.0.1, <=9.1.3)

@octokit/request NPM version =9.0.1, =1.0.4, =1.0.0, =1.3.2 Source cves: CVE-2025-25290 Source advisory: OSV:GHSA-RMVR-2PP2-XJ38...

GHSA-FGW4-V983-MGP8 `gh attestation verify` returns incorrect exit code during verification if no attestations are present

Summary A bug in GitHub's Artifact Attestation CLI tool, gh attestation verify, may return an incorrect zero exit status when no matching attestations are found for the specified --predicate-type or the default https://slsa.dev/provenance/v1 if not specified. This issue only arises if an artifact...

CVE-2025-25204

The CVE-2025-25204 issue affects GitHub CLI (gh) where, in versions 2.49.0 through 2.66.x, a bug in the Artifact Attestation tool gh attestation verify causes a zero exit status when no attestations are present. This incorrect exit code can enable attackers to deploy malicious artifacts in enviro...