CVE-2026-76221

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

CVE-2026-76221

GitPython before 3.1.58 is affected by a config-name injection vulnerability in the option-name validator. The validator fails to properly sanitize option names, allowing an attacker to inject equals signs, hash symbols, and whitespace to forge arbitrary git-config directives. A crafted option na...

CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

CVE-2026-76221 GitPython before 3.1.58 Config Injection via option-name

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

OPENSUSE-SU-2026:21595-1 Security update for python313

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. - CVE-2026-0864: improper handling of...

SUSE-SU-2026:23159-1 Security update for python313

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. - CVE-2026-0864: improper handling of...

Malicious code in ngsw-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b427c73f093ad680033b2779c43c1c96186a71055aaff3cf44befd18c2cecbd The package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node version, package/lifecycle name...

Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

CVE-2026-76008

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

EUVD-2026-62224

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

CVE-2026-76008 Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

CVE-2026-76008

Comfast CF-N1-S 2.6.0.1 has a stack-based buffer overflow in the get_para_from_uri function of /cgi-bin/mbox-config, triggered by manipulating the width/height URI parameters. CVSS 10.0 (Critical) allows unauthenticated remote attackers to achieve full system compromise. No patch or exploit detai...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...

PT-2026-78262

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get para from uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

ansible-core security update

1:2.14.18-3.1 - Fix CVE-2026-11332 prevent arbitrary git configuration via role requirements RHEL-194134...

Oracle Enterprise Manager Cloud Control (August 2026 CSPU)

The 13.5 and 24.1 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component:...

Malicious code in vite-svg-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...

GHSA-7CJ5-V4PP-V632 LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

Summary The graphdescr. family of settings is echoed verbatim without htmlspecialchars in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type. CVSS...