CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

AZL-98198 CVE-2026-72924 affecting package gh 2.62.0-20

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-65091

NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-65099

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-65096

NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

CVE-2026-65086

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...

CVE-2026-65090

NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-65089

NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-65082

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

UBUNTU-CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924

GitHub CLI (gh) versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default, rather than restricting it to loopback. This exposes the forwarded Codespaces service through a wildcard-bound listener on the user's local ...

CVE-2026-72924 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

EUVD-2026-66116

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

Exploit for CVE-2026-56705

CVE-2026-56705: Adminer dsn"sqlsrv:Server=$host" . $port ? "...

CVE-2026-79792 zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. T...

CVE-2026-79792

zackees transcribe-anything up to version 4.1.0 is affected by an OS command injection in the ytdlp_download function within src/transcribe_anything/ytldp_download.py (component: Yt-dlp Download). The flaw is triggered by manipulating the url argument, allowing a remote attacker to execute arbitr...