8051 matches found
PT-2026-29664
Name of the Vulnerable Software and Affected Versions goshs versions 1.1.0 through 2.0.0-beta.2 Description goshs, a SimpleHTTPServer written in Go, has a flaw where the Share Token mechanism can be bypassed. This bypass allows unauthorized access to all goshs functionalities, including code...
PT-2026-29822
Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.15 through 4.5.68 Description PraisonAI is a multi-agent teams system. The --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.open process without validation, allowlist...
GHSA-M8X7-R2RG-VH5G FastMCP has a Command Injection vulnerability - Gemini CLI
Server names containing shell metacharacters e.g., & can cause command injection on Windows when passed to fastmcp install claude-code or fastmcp install gemini-cli. These install paths use subprocess.run with a list argument, but on Windows the target CLIs often resolve to .cmd wrappers that are...
CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...
CVE-2026-34733
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...
CVE-2026-34733
CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...
CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: argo-events, flux-image-automation-controller, pulumi-language-yaml, gitlab-rails-ce-fips, scorecard, gitaly, kubevela, syft, flux-source-controller, argo-workflows, packer, argo-cd, chainctl, pulumi-language-java, teleport, rancher-fleet, kots, cloudbeat,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: argo-events, flux-image-automation-controller, pulumi-language-yaml, gitlab-rails-ce-fips, scorecard, gitaly, kubevela, syft, flux-source-controller, argo-workflows, packer, argo-cd, chainctl, pulumi-language-java, teleport, rancher-fleet, kots, cloudbeat,...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: argo-events, flux-image-automation-controller, pulumi-language-yaml, gitlab-rails-ce-fips, scorecard, gitaly, kubevela, syft, flux-source-controller, argo-workflows, packer, argo-cd, chainctl, pulumi-language-java, teleport, rancher-fleet, kots, cloudbeat,...
GHSA-J3Q9-MXJG-W52F vulnerabilities
Vulnerabilities for packages: langfuse, vitess, opensearch-dashboards-fips, langfuse-fips, thingsboard, code-server, saf, wazuh-dashboard, kibana, tileserver-gl, opensearch-dashboards, redisinsight, tileserver-gl-fips, gemini-cli...
CVE-2026-4926 vulnerabilities
Vulnerabilities for packages: langfuse, vitess, opensearch-dashboards-fips, langfuse-fips, thingsboard, code-server, saf, wazuh-dashboard, kibana, tileserver-gl, opensearch-dashboards, redisinsight, tileserver-gl-fips, gemini-cli...
GHSA-27V5-C462-WPQ7 vulnerabilities
Vulnerabilities for packages: langfuse, vitess, opensearch-dashboards-fips, langfuse-fips, thingsboard, code-server, saf, wazuh-dashboard, kibana, tileserver-gl, opensearch-dashboards, redisinsight, tileserver-gl-fips, gemini-cli...
CVE-2026-4923 vulnerabilities
Vulnerabilities for packages: langfuse, vitess, opensearch-dashboards-fips, langfuse-fips, thingsboard, code-server, saf, wazuh-dashboard, kibana, tileserver-gl, opensearch-dashboards, redisinsight, tileserver-gl-fips, gemini-cli...
CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it...
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
Summary The Handlebars CLI precompiler bin/handlebars / lib/precompiler.js concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits, without any escaping or sanitization. An attacker who can influence template filenames or CLI...
CVE-2026-33748 vulnerabilities
Vulnerabilities for packages: guac, kaniko, osv-scanner, conftest, kubescape, zot, skaffold, docker-compose, docker-cli-buildx, podman, scorecard, trivy-operator, buildah, trivy...
GHSA-4C29-8RGM-JVJJ vulnerabilities
Vulnerabilities for packages: guac, kaniko, osv-scanner, conftest, kubescape, zot, skaffold, docker-compose, docker-cli-buildx, podman, scorecard, trivy-operator, buildah, trivy...