9480 matches found
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
CVE-2026-48501
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...
DEBIAN-CVE-2026-48501
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...
EUVD-2026-33340
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...
Notepad++ config.xml Code Execution
The vulnerability of the config.xml configuration file of the text editor Notepad++ is related to the lack of measures taken to eliminate special elements during the processing of the commandLineInterpreter parameter. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...
GHSA-XX3C-QF5G-HC39 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address
Description Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration e.g. smtp://..., sendmail://..., native://default. SendmailTransport invokes the local sendmail binary and supports two modes: -bs speak SMTP over stdin: the default and -t read the message on...
cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...
Critical: Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update
An update for cockpit is now available for Red Hat Enterprise Linux 10. Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Bug Fixes a...
CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content
GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...
CVE-2026-39828 vulnerabilities
Vulnerabilities for packages: minio, rancher-agent, prometheus, aactl, docker-machine-driver-harvester, helm, kyverno, spire-server, zarf, cloud-provider-aws, flux-image-automation-controller, k9s, trivy, zot, external-secrets-operator, cilium, kine, kubescape, flux-source-controller, gitea,...
CVE-2026-46598 vulnerabilities
Vulnerabilities for packages: minio, rancher-agent, prometheus, aactl, helm, kyverno, spire-server, cloud-provider-aws, zot, external-secrets-operator, cilium, kine, mattermost, loki, istio, kubernetes-dashboard, telegraf, opentelemetry-collector, snyk-cli, kaf, cilium-cli, opentofu,...
CVE-2026-39834 vulnerabilities
Vulnerabilities for packages: kargo, rancher-agent, crossplane-provider-aws-cloudformation, prometheus, aactl, tkn, policy-controller, syft, k9s, crossplane-provider-azure-storage, docker-compose, argo-events, crossplane-provider-aws-ec2, src, k8sgpt, flux-source-controller, gitea, fulcio, hcloud...
CVE-2026-46595 vulnerabilities
Vulnerabilities for packages: omnictl-multiarch, cilium, harbor-fips, kube-arangodb-fips, snyk-cli, gitlab-kas, trivy-fips, commercial-grafana, minio-fips, gatekeeper, kubevela-fips, mattermost, fscrypt, gitlab-rails-ce-fips, frankenphp-8.3, skaffold, osv-scanner, prometheus-mongodb-exporter,...