Directory Traversal

Overview shamefile is a Turn linter suppressions from silent technical debt into reviewable, documented decisions. Affected versions of this package are vulnerable to Directory Traversal via the shame next process when processing a user-controlled shamefile.yaml. An attacker can disclose the...

GHSA-3M4Q-GGCJ-J6M4 Calico Inserts Sensitive Information into Log File

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig with bearer token,...

Calico Inserts Sensitive Information into Log File

When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig with bearer token,...

CVE-2026-45787

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44798 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44798 Source advisory: OSV:PYSEC-2026-2228...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44794 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44794 Source advisory: OSV:PYSEC-2026-2225...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44796 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44796 Source advisory: OSV:PYSEC-2026-2226...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44797 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44797 Source advisory: OSV:PYSEC-2026-2227...

CVE-2026-45021

Kuma CVE-2026-45021 describes a cross-origin exposure in the default kuma-cp config where CorsAllowedDomains: "." and LocalhostIsAdmin: true enable a browser-based attacker to fetch admin credentials from the control plane. Before versions 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, a malicious...

EUVD-2026-32959

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality and integrity failures for synced bookmark/profile data. Attackers can crack common...

CVE-2026-44543

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44465

Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This allows an attacker to achieve Remote Code Execution RCE when a victim open a folder in untrusted mode...

UBUNTU-CVE-2026-44465

Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This allows an attacker to achieve Remote Code Execution RCE when a victim open a folder in untrusted mode...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-48522 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-48522 Source advisory: OSV:PYSEC-2026-175...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-48524 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-48524 Source advisory: OSV:PYSEC-2026-177...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-48526 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-48526 Source advisory: OSV:PYSEC-2026-179...

CVE-2026-44465 Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config

Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This allows an attacker to achieve Remote Code Execution RCE when a victim open a folder in untrusted mode...

CVE-2026-44465

Zed IDE (prior to 0.227.1) is affected. Opening a folder that contains a malicious .git/config file abuses the core.fsmonitor Git configuration option, allowing an attacker to execute arbitrary commands and achieve Remote Code Execution when a user opens the folder in untrusted mode. The issue is...