aws-encryption-sdk-cli (>=2.1.0, <=3.1.0), cloudformation-cli-python-lib (>=2.1.9, <=2.1.16) +2 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=2.0.0, <=3.1.1)

aws-encryption-sdk PYPI version =2.0.0, =2.1.0, =2.1.9, =1.0.0, =1.0.1, =1.0.5 Source cves: CVE-2026-6550 Source advisory: GHSA-V638-38FC-RHFV...

PT-2026-89304

Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli GitHub Action affected versions not specified Description An issue in the Gemini CLI and the associated GitHub Action allows an unprivileged attacker to achieve arbitrary code executio...

PT-2026-37208

Name of the Vulnerable Software and Affected Versions @google/gemini-cli versions prior to 0.39.1 run-gemini-cli affected versions not specified Description Issues exist in the handling of workspace trust and tool allowlisting when running in headless mode, such as within CI/CD environments. In...

PT-2026-51788

Name of the Vulnerable Software and Affected Versions Google Gemini CLI versions prior to 0.39.1 run-gemini-cli GitHub Action versions prior to 0.1.22 Description An OS command injection flaw exists in the container launcher used by Google Gemini CLI and the run-gemini-cli GitHub Action when...

CVE-2026-41247 elFinder: Command injection in resize background color parameter when using ImageMagick CLI

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

CVE-2026-41247 elFinder: Command injection in resize background color parameter when using ImageMagick CLI

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

MAL-2026-3020 Malicious code in @bitwarden/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6fb2336936a86f37fc2018f8e68dc9989ffc3e79aa23297bf470de178201f50 The package @bitwarden/cli was found to contain malicious code. Source: ghsa-malware 8a8c7958926d5ec3795102e9114dfaa649ae3160afb9159ec2c46f044018b776...

Malicious code in @bitwarden/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6fb2336936a86f37fc2018f8e68dc9989ffc3e79aa23297bf470de178201f50 The package @bitwarden/cli was found to contain malicious code. Source: ghsa-malware 8a8c7958926d5ec3795102e9114dfaa649ae3160afb9159ec2c46f044018b776...

Malicious code in changelog-cli-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98a1e229322241da9d146f6aad5c96de566b2707088406fd7de40cbb69445023 The package changelog-cli-logger was found to contain malicious code. Source: ghsa-malware...

Exploit for Path Traversal in Jenkins

jenkinsscan Find jenkins environment and checks for CVE-2024-...

@slidev-react/cli (>=0.4.6, <=0.4.14), @slidev-react/node (>=0.4.6, <=0.4.14) potentially affected by CVE-2026-41211 via vite-plus (0.1.11)

vite-plus NPM version 0.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on vite-plus and may be impacted: - @slidev-react/cli =0.4.6, =0.4.6, =0.4.14 Source cves: CVE-2026-41211 Source advisory: MEND:CVE-2026-41211...

CVE-2026-41247: Improper Neutralization of Special Elements used in an OS Command

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnerability in the resize command. The bg background color parameter is accepted from user input and passed through image resize/rotate processing. In...

Embedded Malicious Code

Overview @bitwarden/cli is an A secure and free password manager for all of your devices. Affected versions of this package are vulnerable to Embedded Malicious Code included in a compromised release that is suspected to be part of the Checkmarx April compromise. The payload is delivered via...

@marko/compiler (5.0.0-next.0), @marko/translator-default (5.0.0-next.0) +4 more potentially affected by CVE-2026-41591 via marko (>=5.0.0-next.0, <=5.21.7)

marko NPM version =5.0.0-next.0, =2.9.2, =1.15.0, =1.1.4, =1.2.1 Source cves: CVE-2026-41591 Source advisory: OSV:GHSA-X9FJ-57FH-C8WQ...

pib-cli (>=0.0.5, <=0.0.6), propylen (>=0.4.0, <=0.4.4) +1 more potentially affected by CVE-2026-41140 via poetry (1.1.15)

poetry PYPI version 1.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - pib-cli =0.0.5, =0.4.0, =0.1.0, =0.3.6 Source cves: CVE-2026-41140 Source advisory: OSV:GHSA-73H3-MF4W-8647...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: OSV:GHSA-9237-RG5P-RHFW...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-9237-RG5P-RHFW...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: GHSA-9237-RG5P-RHFW...