Malicious Package

Overview node-config-svg-contract is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

OESA-2026-3354 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3353 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3313 perl-Config-IniFiles security update

Config::IniFiles is a module intended to make life easier for those who rely on flat configuration files. Security Fixes: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle...

CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

UBUNTU-CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CLEANSTART-2026-TU92934 Security fixes in cass-config-builder-fips 1.0.21-r1

Package cass-config-builder-fips version 1.0.21-r1 fixes 1 vulnerabilities: ghsa-r7wm-3cxj-wff9...

EUVD-2026-57826

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CVE-2026-73622 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

PT-2026-86049

Package cass-config-builder-fips version 1.0.21-r1 fixes 1 vulnerabilities: ghsa-r7wm-3cxj-wff9...

SUSE SLES15: libpython3_12-1_0 / python312 / python312-base / python312-curses / etc (SUSE-SU-2026:3569-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3569-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

CVE-2026-71473

A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container...

CVE-2026-71473

A flaw was found in the search-v2-operator component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container...

CVE-2026-13094

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file...

CVE-2026-19012

A flaw was found in Consul. An authenticated attacker with config-entry write permission can exploit a vulnerability in the Enterprise-to-Community Edition downgrade path. By submitting a specially crafted service-router configuration entry, the attacker can cause the Consul server agent to exit...

CVE-2026-13094

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file...

DEBIAN-CVE-2026-63296

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project's...

DEBIAN-CVE-2026-63298

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.' configuration...