CVE-2026-75166

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...

ROS-20260904-73-0016

The vulnerabilities of the functions Repo.archive, git.lsremote, Repo.itercommits, and Repo.blame in the Python library for interacting with Git repositories in GitPython are related to the lack of data cleaning at the control level. Exploiting these vulnerabilities allows an attacker to execute...

ROS-20260904-73-0014

The vulnerability in freerdp3 is related to the implementation or modification of arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall (CSF) by WebPros maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host . A remote unauthenticated attacker whose address is blocked by CSF can request a mapped executable and run arbitrary commands as the Apa...

CVE-2026-67402

An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerabili...

MAL-2026-15909 Malicious code in 1nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43 Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js...

Malicious code in 1nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43 Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js...

MAL-2026-15908 Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...

Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...

GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks

A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments kwargs to functions such as Repo.clonefrom, Remote.fetch, Remote.pull, or Remote.push. This...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

gitpython: GitPython: Arbitrary command execution via crafted kwargs

A flaw was found in GitPython. A remote attacker can bypass the checkunsafeoptions guard by combining a single-character keyword argument with splitsinglecharoptions=False. This allows the attacker to supply a crafted dictionary of keyword arguments to guarded methods, such as clonefrom, leading ...

gitpython: GitPython: Remote Code Execution via malicious Git template

A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

Updated python-gitpython packages fix security vulnerabilities

CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. CVE-2023-41040 In order to resolve some git references, GitPython reads files from the .git directory, in some places t...

MGASA-2026-0372 Updated python-gitpython packages fix security vulnerabilities

CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. CVE-2023-41040 In order to resolve some git references, GitPython reads files from the .git directory, in some places t...

EUVD-2026-70646

Improper neutralization of special elements used in an OS command CWE-78 in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

CVE-2026-58400 GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...