docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-49460 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-49460 Source advisory: OSV:GHSA-5HGR-HG42-57JG...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-48735 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-48735 Source advisory: OSV:GHSA-WJQC-6W8F-H24C...

Command Injection

Overview browserstack-cypress-cli is a BrowserStack Cypress CLI for Cypress integration with BrowserStack's remote devices. Affected versions of this package are vulnerable to Command Injection via the loadJsFile process in readCypressConfigUtil. An attacker can execute arbitrary commands by...

CVE-2026-42089: Inclusion of Functionality from Untrusted Control Sphere

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass...

CVE-2026-48723 BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypressconfigfile configuration parameter. In readCypressConfigUtil.js, the loadJsFile function constructs a shell...

com.oneandone:snmpman (>=2.0.0-beta, <=2.2.0), com.oneandone:snmpman-cli (>=2.0.0-beta, <=2.2.0) +4 more potentially affected by CVE-2026-39006 via org.snmp4j:snmp4j-agent (>=3.0.0, <=3.8.2)

org.snmp4j:snmp4j-agent MAVEN version =3.0.0, =2.0.0-beta, =2.0.0-beta, =1.0.03, =0.9.03, =3.0.0, =3.0.0, =4.1.1 Source cves: CVE-2026-39006 Source advisory: OSV:GHSA-7H7J-7VWP-CWFG...

com.oneandone:snmpman (>=1.4.2, <=1.4.3), com.oneandone:snmpman-cli (>=1.4.2, <=1.4.3) potentially affected by CVE-2026-39006 via org.snmp4j:snmp4j-agent (2.6.3)

org.snmp4j:snmp4j-agent MAVEN version 2.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.snmp4j:snmp4j-agent and may be impacted: - com.oneandone:snmpman =1.4.2, =1.4.2, =1.4.3 Source cves: CVE-2026-39006 Source advisory: OSV:GHSA-7H7J-7VWP-CWFG...

com.oneandone:snmpman (>=1.4.4, <=1.4.8), com.oneandone:snmpman-cli (>=1.4.4, <=1.4.8) potentially affected by CVE-2026-39006 via org.snmp4j:snmp4j-agent (2.7.1)

org.snmp4j:snmp4j-agent MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.snmp4j:snmp4j-agent and may be impacted: - com.oneandone:snmpman =1.4.4, =1.4.4, =1.4.8 Source cves: CVE-2026-39006 Source advisory: OSV:GHSA-7H7J-7VWP-CWFG...

com.oneandone:snmpman (>=1.3.1, <=1.4.1), com.oneandone:snmpman-cli (>=1.4.0, <=1.4.1) potentially affected by CVE-2026-39006 via org.snmp4j:snmp4j-agent (2.6.2)

org.snmp4j:snmp4j-agent MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.snmp4j:snmp4j-agent and may be impacted: - com.oneandone:snmpman =1.3.1, =1.4.0, =1.4.1 Source cves: CVE-2026-39006 Source advisory: OSV:GHSA-7H7J-7VWP-CWFG...

kaithem (0.95.0), pantra (>=1.4.10, <=1.5.1) +3 more potentially affected by CVE-2026-54282 via starlette (0.51.0)

starlette PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - kaithem 0.95.0 - pantra =1.4.10, =0.1.26, =0.2.0, =0.2.2 - telepact-cli 1.0.0a177 Source cves: CVE-2026-54282 Source advisory:...

beeai-cli (>=0.3.0rc4, <=0.3.4rc1), catweazle (>=1.0.0, <=1.0.2) +16 more potentially affected by CVE-2026-54282 via starlette (0.47.2)

starlette PYPI version 0.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - beeai-cli =0.3.0rc4, =1.0.0, =2.6.1, =1.3.0, =2.37.0, =1.2.5, =1.0.0, =0.12.4, =0.0.1, =1.0.0, =0.1.0, =0.1.34 and more Source cves:...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1004 more potentially affected by CVE-2026-53539 via python-multipart (>=0.0.5, <=0.0.29)

python-multipart PYPI version =0.0.5, =0.5.3, =0.1.0, =0.2.1, =0.2.0, =0.5.1.dev0, =3.2.0, =1.5.2, =0.1.1, =0.1.4b1, =1.0.0, =1.5.5 - agbenchmark 0.0.10 and more Source cves: CVE-2026-53539 Source advisory: OSV:GHSA-5RVQ-CXJ2-64VF...

kaithem (0.95.0), pantra (>=1.4.10, <=1.5.1) +3 more potentially affected by CVE-2026-48818 via starlette (0.51.0)

starlette PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - kaithem 0.95.0 - pantra =1.4.10, =0.1.26, =0.2.0, =0.2.2 - telepact-cli 1.0.0a177 Source cves: CVE-2026-48818 Source advisory:...

kaithem (0.95.0), pantra (>=1.4.10, <=1.5.1) +3 more potentially affected by CVE-2026-48817 via starlette (0.51.0)

starlette PYPI version 0.51.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - kaithem 0.95.0 - pantra =1.4.10, =0.1.26, =0.2.0, =0.2.2 - telepact-cli 1.0.0a177 Source cves: CVE-2026-48817 Source advisory:...

Arbitrary Code Injection

Overview protobufjs-cli is a Translates between file formats and generates static code as well as TypeScript definitions. Affected versions of this package are vulnerable to Arbitrary Code Injection via the pbjs static code generation. An attacker can execute arbitrary code by providing crafted...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: OSV:GHSA-PR59-H9PH-3FR8...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: GHSA-PR59-H9PH-3FR8...

NPM: protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

NPM: protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names vulnerability discovered by ? in WordPress Npm protobufjs-cli versions = 1.3.1...

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

Summary A previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas fro...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1527 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJSCLI-17362836...