CVE Vulnerability Advisory Database

[Affected Scope] Nx Console extension version 18.95.0 distributed via VS Code Marketplace and OpenVSX

[Impact] Execution of arbitrary malicious code within the developer's local environment, potentially leading to credential theft and full system compromise

[Mitigation] Immediately uninstall the compromised version 18.95.0 and upgrade to the clean version 18.100.0 or higher

[Affected Scope] All web applications utilizing Starlette ASGI framework prior to version 1.0.1

[Impact] Malformed Host headers can cause a discrepancy between the actual routed path and request.url.path, allowing attackers to bypass URL-based security middleware and access controls

[Mitigation] Immediately upgrade the Starlette package to version 1.0.1 or higher

[Affected Scope] 84 malicious versions across 42 @tanstack/* packages published between 19:20 and 19:26 UTC on 2026-05-11

[Impact] Attackers successfully published credential-stealing malware under trusted identities by hijacking legitimate OIDC tokens

[Mitigation] Immediately audit dependency trees, purge affected package versions, and rotate all potentially exposed credentials

[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0

[Impact] Unauthenticated remote attackers can establish a connection to the /terminal/ws endpoint, obtaining a full PTY shell and executing arbitrary system commands

[Mitigation] Immediately upgrade the marimo package to version 0.23.0 or higher

[Affected Scope] docling-core versions from v2.21.0 prior to v2.48.4, specifically when paired with pyyaml versions prior to v5.4

[Impact] Remote attackers can execute arbitrary Python code on the target server by supplying malicious YAML data to the load_from_yaml() method

[Mitigation] Upgrade docling-core to version v2.48.4 or later, or ensure the installed PyYAML version is v5.4 or greater

[Affected Scope] All systems and CI/CD pipelines running GuardDog versions prior to 2.7.1

[Impact] Malicious PyPI packages can exploit path traversal to write arbitrary files outside the extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution (RCE)

[Mitigation] Immediately upgrade GuardDog to version 2.7.1 or higher

[Affected Scope] The .github/workflows/ci.yml workflow configuration in the Eigent open-source repository

[Impact] Arbitrary code execution from fork pull requests, allowing attackers to steal credentials, push unauthorized code, or create malicious releases

[Mitigation] Apply the official patch commits or update the GitHub Actions workflow configuration to restrict untrusted code execution

[Affected Scope] n8n versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0

[Impact] Authenticated attackers can exploit an insufficiently isolated execution context during expression evaluation to execute arbitrary system commands with n8n process privileges, potentially leading to full instance compromise

[Mitigation] Immediately upgrade n8n to patched versions (1.120.4, 1.121.1, or 1.122.0 and above)

[Affected Scope] Langflow versions up to and including 1.6.9

[Impact] Attackers can hijack victim sessions to take over accounts and execute arbitrary code via built-in code execution features, leading to full system compromise

[Mitigation] Upgrade Langflow to the latest patched version, restrict CORS configurations, and update refresh token cookie attributes to Lax/Strict

[Affected Scope] Laravel Livewire versions v3.0.0 up to and including v3.6.3

[Impact] Unauthenticated remote attackers can exploit the component hydration process to execute arbitrary system commands on the host server

[Mitigation] Immediately upgrade the Livewire package to the patched version v3.6.4 or later

[Affected Scope] All Git versions prior to v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1

[Impact] A remote attacker can craft a malicious repository with specially designed submodule paths and symlinks, leading to arbitrary post-checkout hook execution and full system compromise upon cloning.

[Mitigation] Immediately upgrade Git clients to the patched versions (e.g., v2.50.1) and avoid recursively cloning untrusted repositories.

[Affected Scope] Erlang/OTP versions prior to OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20

[Impact] Unauthenticated remote attackers can exploit a flaw in SSH protocol message handling to execute arbitrary commands and gain full system control without valid credentials

[Mitigation] Immediately upgrade Erlang/OTP to patched versions (OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20) or temporarily disable the SSH server and restrict access via firewall rules

[Affected Scope] Yii 2 framework versions prior to 2.0.52

[Impact] Remote attackers can execute arbitrary PHP code on the server and fully compromise the system via specially crafted requests.

[Mitigation] Immediately upgrade the Yii2 framework to the patched version 2.0.52 or higher.

[Affected Scope] Workflows executing reviewdog/action-setup@v1 and dependent actions between March 11, 2025, 18:42 and 20:31 UTC

[Impact] Malicious code injected into the action dumps exposed secrets to GitHub Actions Workflow Logs, leading to potential credential theft

[Mitigation] Immediately revoke and rotate all secrets exposed during the compromised window, and pin actions to secure commit SHA hashes

[Affected Scope] GitHub Actions workflows utilizing tj-actions/changed-files action versions v1 through v45.0.7

[Impact] Threat actors modified release tags to point to a malicious commit (0e58ed8), enabling execution of malicious code ('updateFeatures') and exfiltration of GitHub Secrets via action logs

[Mitigation] Immediately cease using the affected tags and upgrade to v46 or later, or pin the action to a trusted commit SHA

[Affected Scope] Jenkins weekly version 2.441 and earlier, LTS version 2.426.2 and earlier

[Impact] Unauthenticated attackers can read arbitrary files on the Jenkins controller file system, potentially leading to Remote Code Execution (RCE) under specific conditions

[Mitigation] Immediately upgrade Jenkins weekly to 2.442 or later, and LTS to 2.426.3 or later, or disable CLI access

[Affected Scope] GitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)

[Impact] An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.

[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).

[Affected Scope] All applications utilizing Spreadsheet::ParseExcel library version 0.65 and prior

[Impact] Remote attackers can execute arbitrary Perl code and gain full system privileges by tricking the application into parsing a specially crafted Excel file

[Mitigation] Immediately upgrade the Spreadsheet::ParseExcel module to the patched version (0.66 or later)

[Affected Scope] Google Chrome versions prior to 117.0.5938.132 and libvpx versions prior to 1.13.1.

[Impact] A remote attacker can trigger heap corruption via a crafted HTML page, potentially leading to arbitrary remote code execution (RCE).

[Mitigation] Immediately update Google Chrome to the latest version and upgrade the libvpx library dependency to v1.13.1 or higher in all environments.

[Affected Scope] All on-premises versions of JetBrains TeamCity prior to 2023.05.4

[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, hijack build pipelines, and execute arbitrary code on the server

[Mitigation] Immediately upgrade TeamCity server to version 2023.05.4 or later, or apply the official security patch plugin