CVE-2026-34603: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the...

PT-2026-29822

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.15 through 4.5.68 Description PraisonAI is a multi-agent teams system. The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.open process without validation, allowlist...

PT-2026-29664

Name of the Vulnerable Software and Affected Versions goshs versions 1.1.0 through 2.0.0-beta.2 Description goshs, a SimpleHTTPServer written in Go, has a flaw where the Share Token mechanism can be bypassed. This bypass allows unauthorized access to all goshs functionalities, including code...

PT-2026-32066

Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...

Telnet CLI Arbitrary Command Execution

The vulnerability of the Telnet command-line interface CLI of TP-Link’s TL-MR6400 v5.3 router software relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary system command...

GHSA-M8X7-R2RG-VH5G FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...

CVE-2026-34733

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

@akashic/akashic-cli (>=2.16.49, <=2.17.21), @akashic/akashic-cli-export (>=1.8.28, <=1.9.17) +250 more potentially affected by CVE-2026-2950 via lodash.unset (>=4.0.2, <=4.5.2)

lodash.unset NPM version =4.0.2, =2.16.49, =1.8.28, =1.2.1, =1.8.4, =8.0.0, =1.0.75, =0.0.2, =0.1.0, =1.31.9, =0.0.4, =0.6.0 and more Source cves: CVE-2026-2950 Source advisory: MEND:CVE-2026-2950...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: cg, pulumi-language-java, teleport, gptscript, gitea-fips, flux-source-controller, cerbos-fips, flux-image-automation-controller-fips, chezmoi, grype, cerbos, argo-cd, amazon-ssm-agent, zarf, argocd-image-updater-fips, steampipe, wolfictl, kargo, packer-fips,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: cg, pulumi-language-java, teleport, gptscript, gitea-fips, flux-source-controller, cerbos-fips, flux-image-automation-controller-fips, chezmoi, grype, cerbos, argo-cd, amazon-ssm-agent, zarf, argocd-image-updater-fips, steampipe, wolfictl, kargo, packer-fips,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: cg, pulumi-language-java, teleport, gptscript, gitea-fips, flux-source-controller, cerbos-fips, flux-image-automation-controller-fips, chezmoi, grype, cerbos, argo-cd, amazon-ssm-agent, zarf, argocd-image-updater-fips, steampipe, wolfictl, kargo, packer-fips,...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-34073 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

aba-cli-scrapper (>=0.6.0, <=0.7.6), agixt (>=1.7.0, <=1.7.2) +130 more potentially affected by CVE-2026-34073 via cryptography (43.0.1)

cryptography PYPI version 43.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aba-cli-scrapper =0.6.0, =1.7.0, =3.0.0, =2.9.0, =0.2.1, =0.0.81, =1.0.648, =1.0.2, =0.1.0.post173, =0.1.1, =1.1.45, =0.0.1, =0.0.5 and...

ais-dom (>=0.92.5, <=0.95.7), bitwarden-simple-cli (>=1.0.0, <=1.3.1) +29 more potentially affected by CVE-2026-34073 via cryptography (2.6.1)

cryptography PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.92.5, =1.0.0, =1.7.1, =0.2.5, =0.0.0, =0.0.17, =0.0.1.dev33, =0.1.8, =0.4.3, =0.1.0, =1.0.5 - ezissue-br 1.0.0 and more Sourc...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-34073 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...

algorin-cli (>=0.0.1, <=0.21.0), alita-sdk (>=0.0.1, <=0.0.16) +1 more potentially affected by CVE-2026-34070 via langchain-core (0.1.30)

langchain-core PYPI version 0.1.30 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - algorin-cli =0.0.1, =0.0.1, =0.0.2, =0.0.6 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-34070 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...