CVE-2026-20040

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI...

CVE-2026-20046

CVE-2026-20046 affects Cisco IOS XR Software. The vulnerability stems from an incorrect mapping of a CLI command to task groups, allowing an authenticated, low-privileged local attacker to bypass task group checks and elevate privileges to full administrative control. Impact stated as privilege e...

com.buschmais.jqassistant.cli:application (>=1.7.0-rc1, <=2.10.0-m4), com.buschmais.jqassistant.cli:jqassistant-commandline-distribution (>=2.0.0-m3, <=2.0.10) +112 more potentially affected by CVE-2026-1524 via org.neo4j.community:it-test-support (>=3.5.0-beta02, <=5.26.21)

org.neo4j.community:it-test-support MAVEN version =3.5.0-beta02, =1.7.0-rc1, =2.0.0-m3, =1.7.0-rc1, =2.1.0-m1, =2.1.0-m1, =1.7.0-rc1, =1.7.0-rc1, =1.12.0-m1, =2.4.0-m1, =1.7.0-rc1, =1.10.0-alpha1, =2.0.0-rc2, =1.7.0-rc1, =1.7.0-rc1, =1.12.0-m1, =2.10.0-m4 and more Source cves: CVE-2026-1524 Sourc...

GHSA-VV3H-7QWR-722V Anytype Heart's gRPC API client challenge verification can be bypassed on localhost

Impact The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. Affected components: - Anytype Desktop all platforms ≤ v0.48.2 - Anytype-CLI headless deployments ≤ v0.1.9 Not affected: - Anytype mobile apps iOS...

EUVD-2026-11080

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior...

CVE-2026-23816

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-23815

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands...

CVE-2026-23816 Authenticated Command Injection found in admin AOS-CX CLI command

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-23815 Authenticated Command Injection found in AOS-CX Administrative CLI Command

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands...

CVE-2026-23814

This CVE concerns a vulnerability in the AOS-CX CLI where command parameters can be exploited to inject malicious commands by a low-privileged, authenticated remote attacker. The issue is actionable via network access, with no user interaction required, and it affects the ability to maintain conf...

CVE-2026-23814 Authenticated Command Injection found in AOS-CX CLI Command

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior...

CVE-2026-23814 Authenticated Command Injection found in AOS-CX CLI Command

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior...

GHSA-XJ69-M9QQ-8M94 Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing

Impact Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-31826 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-31826 Source advisory: OSV:GHSA-HQMH-PPP3-XVM7...

PT-2026-24753

Summary Multiple Git-related API endpoints use execAsync with string interpolation of user-controlled parameters file, branch, message, commit, allowing authenticated attackers to execute arbitrary OS commands. Details The claudecodeui application provides Git integration through various API...

PT-2026-24729

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups...

Cloud CLI Code Injection Vulnerability

Cloud CLI is a multi-model AI programming assistant desktop and mobile interface open-sourced by Siteboon. Versions of Cloud CLI prior to 1.24.0 contained a code injection vulnerability. This vulnerability stemmed from the /api/user/git-config endpoint constructing shell commands without properly...

CVE-2026-31861: Improper Control of Generation of Code

Cloud CLI aka Claude Code UI is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, The /api/user/git-config endpoint constructs shell commands by interpolating user-supplied gitName and gitEmail values into command strings passed to childprocess.exec. The...

CVE-2026-31863: Improper Restriction of Excessive Authentication Attempts

Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5...

Cloud CLI operating system command injection vulnerability

Cloud CLI is a multi-model AI programming assistant desktop and mobile interface open-sourced by Siteboon. Versions of Cloud CLI prior to 1.24.0 contained an operating system command injection vulnerability. This vulnerability stemmed from the use of string interpolation for user input across...