homeassistant-cli (0.2.0) potentially affected by CVE-2026-54317 via homeassistant (0.83.3)

homeassistant PYPI version 0.83.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-cli 0.2.0 Source cves: CVE-2026-54317 Source advisory: OSV:PYSEC-2026-241...

@zuplo/cli (>=6.51.52, <=7.8.11), zuplo (>=6.3.1, <=7.8.11) potentially affected by CVE-2026-44726 via deno (2.3.1)

deno NPM version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on deno and may be impacted: - @zuplo/cli =6.51.52, =6.3.1, =7.8.11 Source cves: CVE-2026-44726 Source advisory: MEND:CVE-2026-44726...

Malicious Package

Overview vitest-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: syft-fips, kargo, headlamp, beats, trivy-operator-fips, zot, containerd, envoy-gateway, amazon-ecs-agent-fips, tigera-operator, tekton-pipelines, chartmuseum, kubevela, chainctl, docker-fips, gatekeeper, packer-fips, helm-push, eksctl, helm-exporter, helmfile, docker...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: syft-fips, kargo, headlamp, beats, trivy-operator-fips, zot, containerd, envoy-gateway, amazon-ecs-agent-fips, tigera-operator, tekton-pipelines, chartmuseum, kubevela, chainctl, docker-fips, gatekeeper, packer-fips, helm-push, eksctl, helm-exporter, helmfile, docker...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: syft-fips, kargo, headlamp, beats, trivy-operator-fips, zot, containerd, envoy-gateway, amazon-ecs-agent-fips, tigera-operator, tekton-pipelines, chartmuseum, kubevela, chainctl, docker-fips, gatekeeper, packer-fips, helm-push, eksctl, helm-exporter, helmfile, docker...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: syft-fips, kargo, headlamp, trivy-operator-fips, zot, envoy-gateway, amazon-ecs-agent-fips, tigera-operator, chartmuseum, kubevela, chainctl, docker-fips, gatekeeper, packer-fips, helm-push, eksctl, helm-exporter, helmfile, docker, helm-exporter-fips,...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-54353 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-54353 Source advisory: GHSA-GFQ7-5X4G-3XHF...

CSV Injection

Overview @actual-app/cli is a CLI for Actual Budget Affected versions of this package are vulnerable to CSV Injection via the escapeCsv function, which fails to neutralize formula-triggering prefixes in user-controlled fields when exporting data to CSV format. An attacker can cause arbitrary...

io.spinnaker.keel:keel-artifact (>=2026.0-19, <=2026.0-23), io.spinnaker.keel:keel-bakery-plugin (>=2026.0-19, <=2026.0-23) +19 more potentially affected by CVE-2026-44795 via io.spinnaker.keel:keel-core (>=2026.0-19, <=2026.0-23)

io.spinnaker.keel:keel-core MAVEN version =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-23 and more Source cves: CVE-2026-44795 Source advisory...

agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-41479 via authlib (1.7.0)

authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-41479 Source advisory: MEND:CVE-2026-41479...

GO-2026-5063 Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli...

alita-sdk (>=0.0.1, <=0.0.16), code-agent (>=0.2.0.0, <=0.3.0.1) +9 more potentially affected by CVE-2026-55443 via langchain (0.1.11)

langchain PYPI version 0.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - alita-sdk =0.0.1, =0.2.0.0, =0.0.10, =0.0.2, =0.0.0, =0.1.0, =0.0.0, =0.10.4, =0.11.1 - wolfcode 0.1.0 Source cves: CVE-2026-55443 Source...

agenta (>=0.50.5, <=0.64.0), agentstack-cli (>=0.4.0rc1, <=0.4.3) +104 more potentially affected by CVE-2026-54282 via starlette (0.47.3)

starlette PYPI version 0.47.3 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agenta =0.50.5, =0.4.0rc1, =0.0.7, =1.0.0, =1.1.0, =1.0.4, =0.3.4rc4, =6.4.21, =1.0.0, =0.0.6, =1.1.8, =0.12.0, =0.0.10, =0.7.0, =1.7.0 and...

kaithem (0.95.0), pantra (>=1.4.10, <=1.5.1) +3 more potentially affected by CVE-2026-54282 via starlette (0.51.0)

starlette PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - kaithem 0.95.0 - pantra =1.4.10, =0.1.26, =0.2.0, =0.2.2 - telepact-cli 1.0.0a177 Source cves: CVE-2026-54282 Source advisory:...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1004 more potentially affected by CVE-2026-53537 via python-multipart (>=0.0.5, <=0.0.29)

python-multipart PYPI version =0.0.5, =0.5.3, =0.1.0, =0.2.1, =0.2.0, =0.5.1.dev0, =3.2.0, =1.5.2, =0.1.1, =0.1.4b1, =1.0.0, =1.5.5 - agbenchmark 0.0.10 and more Source cves: CVE-2026-53537 Source advisory: MEND:CVE-2026-53537...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54269 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54269 Source advisory: MEND:CVE-2026-54269...

CVE-2026-54271 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static outp...

CVE-2026-54271 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static outp...

CVE-2026-54271

The CVE-2026-54271 entry concerns protobufjs-cli (pbjs) static code generation, where insecure handling of pre-parsed JSON descriptors could lead to attacker-controlled JavaScript in generated output. Concrete details across connected sources show that protobufjs-cli versions prior to the fixed r...