EUVD-2026-3099

Malicious code in kc-fe-cli npm...

01-numacert (>=1.0.0, <=3.0.0), 12g (>=0.0.15, <=1.0.1) +7548 more potentially affected by CVE-2026-24001 via diff (>=3.0.0, <=3.5.0)

diff NPM version =3.0.0, =1.0.0, =0.0.15, =1.0.4, =5.4.4, =5.4.4, =2.2.1, =1.1.8, =1.0.0, =2.0.0, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =1.8.1 and more Source cves: CVE-2026-24001 Source advisory: GHSA-73RR-HH4G-FPGX...

CVE-2026-22820 Outray cli is vulnerable to race conditions in tunnels creation

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5...

CVE-2026-22820 Outray cli is vulnerable to race conditions in tunnels creation

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5...

CVE-2026-22718

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine...

CVE-2026-22718 Command injection vulnerability

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine...

CVE-2026-22718

The CVE-2026-22718 entry concerns the VSCode extension for Spring CLI, attributed to VMware, with a vulnerability allowing command injection and subsequent command execution on the user’s machine. Connected advisories consistently describe this as a vulnerability in the Spring CLI VSCode extensio...

CVE-2026-22718 Command injection vulnerability

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine...

CVE-2026-22718: Improper Neutralization of Special Elements used in an OS Command

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine...

PT-2026-2793

The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine...

CVE-2022-50911

...

afipcaeqrdecode (0.0.15), afw (>=0.0.6, <=0.0.21) +215 more potentially affected by CVE-2026-23949 via jaraco-context (>=5.3.0, <=6.0.2)

jaraco-context PYPI version =5.3.0, =0.0.6, =0.1.0, =0.1.23, =0.0.1, =0.9.5, =1.0.5, =0.1.6, =0.1.0, =0.0.1, =0.0.2, =0.1.2, =1.0.1, =1.0.1.9 and more Source cves: CVE-2026-23949 Source advisory: OSV:GHSA-58PV-8J8X-9VJ2...

CVE-2025-37177

An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation of this vulnerability could allow an authenticated remote malicious actor to delete arbitrary files within th...

ddwrt-tracker (>=0.0.1.dev33, <=0.0.1.dev34), dokos-cli (>=2.0.0, <=2.1.0) +3 more potentially affected by CVE-2026-22702 via virtualenv (16.6.0)

virtualenv PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ddwrt-tracker =0.0.1.dev33, =2.0.0, =5.0.0, =0.0.0, =0.0.0, =1.9.1 Source cves: CVE-2026-22702 Source advisory: OSV:GHSA-597G-3PHW-6986...

bento-cli (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-22702 via virtualenv (16.7.5)

virtualenv PYPI version 16.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bento-cli =0.1.0, =0.1.1 Source cves: CVE-2026-22702 Source advisory: OSV:GHSA-597G-3PHW-6986...

CVE-2026-22251 wlc may leak API keys due to an insecure API key configuration

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers...

CVE-2026-22251

The CVE-2026-22251 entry concerns the wlc Weblate command-line client. Before version 1.17.0, wlc allowed unscoped API keys to be stored in settings, a practice that could enable an API key to be leaked to different servers. Public advisories from Debian/Ubuntu/OSV reflect this issue and referenc...

(0Day) npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-22691 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-22691 Source advisory: OSV:GHSA-4F6G-68PF-7VHV...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-22690 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-22690 Source advisory: OSV:GHSA-4XC4-762W-M6CG...