bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2026-44243 via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2026-44243 Source advisory: OSV:PYSEC-2026-2162...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-44243 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-44243 Source advisory:...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2026-42284 via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2026-42284 Source advisory: OSV:PYSEC-2026-2161...

arca (>=0.1.1, <=0.3.1), epab (>=2018.4.2.1, <=2018.4.2.3) +3 more potentially affected by CVE-2026-42284 via gitpython (2.1.9)

gitpython PYPI version 2.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.1, =2018.4.2.1, =1.0.3, =0.0.0, =0.4.1 - ubuntudesign-documentation-builder 1.6.0 Source cves: CVE-2026-42284 Source advisory:...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 27, 2026 to May 3, 2026)

Last week, there were 87 vulnerabilities disclosed in 198 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 61 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities ...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-42259 Source advisory: MEND:CVE-2026-42259...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.4) potentially affected by CVE-2026-42259 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.4)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-42259 Source advisory: MEND:CVE-2026-42259...

@xapp/cli (1.8.11), stentor (>=1.68.30, <=1.72.1) +9 more potentially affected by CVE-2026-43998 via vm2 (3.10.5)

vm2 NPM version 3.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @xapp/cli 1.8.11 - stentor =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.72.1 Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-43998 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44004 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@xapp/cli (1.8.11), stentor (>=1.68.30, <=1.72.1) +9 more potentially affected by CVE-2026-43999 via vm2 (3.10.5)

vm2 NPM version 3.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @xapp/cli 1.8.11 - stentor =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.72.1 Source cves:...

@xapp/cli (1.8.11), stentor (>=1.68.30, <=1.72.1) +9 more potentially affected by CVE-2026-43999 via vm2 (3.10.5)

vm2 NPM version 3.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @xapp/cli 1.8.11 - stentor =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.72.1 Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-43997 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44006 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4391 more potentially affected by CVE-2026-41674 via @xmldom/xmldom (>=0.7.0, <=0.8.12)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.0.1, =0.0.2 - @abcd19/st-grid 3.1.0 and more Source cves: CVE-2026-41674 Source advisory: MEND:CVE-2026-41674...

CVE-2026-42338 vulnerabilities

Vulnerabilities for packages: gemini-cli, renovate, graalvm, kibana, kubeflow-katib, drupal, npm, opensearch-dashboards, langfuse, prism, langfuse-fips, kubeflow-pipelines, wazuh-dashboard, sqlpad, actions-runner, pulumi, code-server, commercial-gitlab-rails-ee-fips, saf,...

GHSA-PGF8-2HGJ-GRQG Vercel: Non-interactive mode includes CLI arguments in suggested command output

Summary When the Vercel CLI runs in non-interactive mode --non-interactive or auto-detected AI agent, commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included...

NPM: Vercel: Non-interactive mode includes CLI arguments in suggested command output

NPM: Vercel: Non-interactive mode includes CLI arguments in suggested command output vulnerability discovered by ? in WordPress Npm vercel versions = 50.16.0, = 52.0.0...

CLI Proxy API code-related vulnerabilities

CLI Proxy API is an open-source CLI proxy server developed by Router-For.ME, which supports multi-model APIs. Version 6.9.29 of the CLI Proxy API has a code vulnerability that stems from the handling of the url parameter in the file internal/api/handlers/management/apitools.go. This vulnerability...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...