CVE-2026-34733

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-34730 via copier (8.3.0)

copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-34730 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34730 Source advisory: OSV:GHSA-HGJQ-P8CR-GG4H...

data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2026-34730 via copier (7.0.1)

copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2026-34730 Source advisory: OSV:GHSA-HGJQ-P8CR-GG4H...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-34726 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34726 Source advisory: OSV:GHSA-85V3-4M8G-HRH6...

data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2026-34726 via copier (7.0.1)

copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2026-34726 Source advisory: OSV:GHSA-85V3-4M8G-HRH6...

EUVD-2026-17652

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard...

AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

Summary The AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !phpsapiname === 'cli' never evaluates to true due to how PHP...

CLEANSTART-2026-WZ18491 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-33186 applied in versions: 0.28.7-r1, 0.29.0-r0, 0.30.0-r0

Multiple security vulnerabilities affect the step-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JJ09127 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2026-33186 applied in versions: 0.28.7-r1, 0.29.0-r0, 0.30.0-r0

Multiple security vulnerabilities affect the step-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.3.30), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.1.11) +4 more potentially affected by CVE-2026-34604 via @tinacms/graphql (>=2.0.0, <=2.2.0)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.6.3 Source cves: CVE-2026-34604 Source advisory: GHSA-G9C2-GF25-3X67...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34603 Source advisory: GHSA-G87C-R2JP-293W...

PT-2026-32066

Summary OpenClaw loaded the current working directory .env before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values. Impact A repository or workspace containing a malicious .env file could override runtime configuration and security-sensitive...

CVE-2026-34603: Improper Limitation of a Pathname to a Restricted Directory

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the...

PT-2026-29664

Name of the Vulnerable Software and Affected Versions goshs versions 1.1.0 through 2.0.0-beta.2 Description goshs, a SimpleHTTPServer written in Go, has a flaw where the Share Token mechanism can be bypassed. This bypass allows unauthorized access to all goshs functionalities, including code...

PT-2026-29822

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.15 through 4.5.68 Description PraisonAI is a multi-agent teams system. The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.open process without validation, allowlist...

Telnet CLI Arbitrary Command Execution

The vulnerability of the Telnet command-line interface CLI of TP-Link’s TL-MR6400 v5.3 router software relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary system command...

GHSA-M8X7-R2RG-VH5G FastMCP has a Command Injection vulnerability - Gemini CLI

Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...