Fortinet FortiSandbox 路径遍历漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection device developed by the American company Fortinet. This device offers features such as dual sandbox technology, dynamic threat intelligence systems, a real-time control panel, and reporting capabilities. Fortinet FortiSandbox h...

CVE-2025-61260

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...

CVE-2025-61260

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP Model Context Protocol configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads...

CVE-2025-61260

The CVE-2025-61260 issue affects the OpenAI Codex CLI, specifically versions prior to 0.23.0. The root cause is improper handling of repository-local configuration files (notably .env and .codex/config.toml) that are loaded automatically when the codex command is executed in a malicious or compro...

CVE-2026-33948 jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen to determine buffer length instead of the actual byte...

CVE-2026-21916

A UNIX Symbolic Link Symlink Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system. When after a user has performed a specific 'file lin...

CVE-2026-21915

A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights JSI Virtual Lightweight Collector vLWC allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without carefully validating it, which allows for shell...

Security Bulletin: IBM Planning Analytics Cartridge has addressed a security vulnerability in Docker CLI (CVE-2025-15558)

Summary IBM Planning Analytics Cartridge is considered affected by a vulnerability in Docker CLI Vulnerability Details CVEID:CVE-2025-15558 DESCRIPTION: Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A...

OPENSUSE-SU-2026:10539-1 oci-cli-3.76.2-1.1 on GA media

These are all security issues fixed in the oci-cli-3.76.2-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: kuma, helm-set-status, helm-push, helm-exporter-fips, helm-diff-fips, helm-mapkubeapis, kube-arangodb-fips, kubescape, jfrog-cli, cloudbeat-fips, cluster-api-helm-controller, chaos-mesh, eksctl, istio, tigera-operator-fips, gitlab-operator-fips, cilium-cli,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, gitlab-kas, aws-flb-kinesis, libnvidia-container, kaf, nerdctl, cert-manager, aws-flb-firehose, spire-server, external-dns, mattermost, cilium-cli, datadog-agent, kube-fluentd-operator, kubernetes-csi-node-driver-registrar, kots, kubescape, kine...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, crane, kargo, net-kourier, sbom-convert, postgres-operator, weaviate, smarter-device-manager, container-object-storage-interface, cluster-autoscaler, tigera-operator, hugo-extended, aws-application-networking-k8s, rancher-webhook, cilium,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: authservice, policy-controller, gcsfuse, swagger, cortex, knative-eventing, kaf, kargo, kube-state-metrics, kubernetes-dashboard-auth, aws-flb-firehose, lazydocker, spire-server, falco-exporter, docker-machine-driver-harvester, terraform-provider-azapi, net-kourier,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: helm-diff-fips, scorecard, terraform-fips, coredns, regclient, tofu-controller-fips, gitness, buildkite-agent, kots, rancher-fleet-fips, kbld, crane-fips, mattermost-fips, kubernetes-csi-driver-nfs-fips, mesosphere-vsphere-csi, gitleaks, filebrowser, rancher-machine,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: helm-diff-fips, scorecard, terraform-fips, coredns, regclient, tofu-controller-fips, gitness, buildkite-agent, kots, rancher-fleet-fips, kbld, crane-fips, mattermost-fips, kubernetes-csi-driver-nfs-fips, mesosphere-vsphere-csi, gitleaks, filebrowser, rancher-machine,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: k8s-metacollector-fips, crossplane-provider-aws-cognitoidentity-fips, kyverno-policy-reporter-plugins-trivy-fips, helm-diff-fips, crossplane-provider-aws-s3-fips, scorecard, contour, victoriametrics-operator-fips, custom-pod-autoscaler, terraform-fips, coredns, s5cmd...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: k8s-metacollector-fips, crossplane-provider-aws-cognitoidentity-fips, kyverno-policy-reporter-plugins-trivy-fips, helm-diff-fips, crossplane-provider-aws-s3-fips, scorecard, contour, victoriametrics-operator-fips, custom-pod-autoscaler, terraform-fips, coredns, s5cmd...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: k8s-metacollector-fips, crossplane-provider-aws-cognitoidentity-fips, kyverno-policy-reporter-plugins-trivy-fips, helm-diff-fips, crossplane-provider-aws-s3-fips, scorecard, contour, victoriametrics-operator-fips, custom-pod-autoscaler, terraform-fips, coredns, s5cmd...

CVE-2026-5059 aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handlin...

tekton-cli-0.44.1-1.1 on GA media (moderate)

tekton-cli-0.44.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10529-1 Rating: moderate Cross-References: CVE-2026-33211 CVE-2026-34986 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issues fixed in the...