CVE-2026-17113 Cri-o: cri-o: unvalidated image env var causes daemon crash

A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...

Malicious code in poly-price-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...

Malicious code in dotish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...

EUVD-2026-64183

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

PT-2026-79494

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

MAL-2026-14272 Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...

GO-2026-6225 Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

CVE-2026-50187 Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

CVE-2026-50187

The dotenv plugin in plugins/dotenv/dotenv.plugin.zsh calls source on ZSH_DOTENV_FILE after cd into a directory containing a .env file, executing arbitrary shell commands with the user's privileges. Exploitation requires the user to navigate into a directory containing a malicious .env; no in-the...

PT-2026-77166

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API...

GHSA-QMCQ-XW74-W667 uniget CLI has an EDITOR Command Injection

Summary The uniget CLI has a command injection vulnerability in hooks.go line 199 where strings.Spliteditor, " " naively parses the EDITOR environment variable without respecting shell syntax. An attacker can set EDITOR="/path/to/wrapper && id && echo" which gets split into separate arguments,...

CVE-2026-73047 siyuan before v3.7.4 Server-Side Template Injection via attribute-view

siyuan versions = 3.7.3 fixed in v3.7.4 contain a server-side template injection vulnerability in the attribute-view Template calculation feature introduced in v3.7.0-beta.1. The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and...

Malicious code in rimo-env-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56f06dbeb4a580e0e33781dc75aeea4c844f8de804be52f0a43097d85739c53c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env-fips, dgraph, docker-credential-acr-env, gitness...

GO-2020-0017 vulnerabilities

Vulnerabilities for packages: gitness, docker-credential-acr-env, dgraph...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: argo-cd, promxy, contour, prometheus, swagger, cortex, cilium-envoy, crossplane-provider-aws-cloudfront, falco-no-driver, kubernetes-csi-external-attacher, kubernetes-dashboard-auth, newrelic-fluent-bit-output, cilium, trino, crossplane-provider-aws-memorydb, cadviso...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: envconsul, promxy, contour, kwok, infinispan-operator, age, falco-no-driver, hydra, kubernetes-csi-external-attacher, git-credential-oauth, metacontroller, mockery, rancher-loglevel, kube-logging-operator-custom-runner, kube-bench, nerdctl, cadvisor, checksec,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: envconsul, promxy, contour, kwok, infinispan-operator, age, falco-no-driver, hydra, kubernetes-csi-external-attacher, git-credential-oauth, metacontroller, mockery, rancher-loglevel, kube-logging-operator-custom-runner, kube-bench, nerdctl, cadvisor, checksec,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: temporal-ui-server, flux-kustomize-controller, cortex, ollama, up, nri-kafka, kubeflow-pipelines, cadvisor, grpc-health-probe, nerdctl, argo-workflows, kubernetes-dashboard, dex, nsc, kubernetes-event-exporter, crossplane-provider-azure-sql, certificate-transparency,...