CVE-2026-96808

A flaw was found in Flatpak. A malicious local user in an active local session could exploit a symlink traversal vulnerability in the revokefs writer. This flaw allows an attacker to modify files belonging to a different revokefs session after they have been validated. Consequently, an attacker...

DEBIAN-CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

UBUNTU-CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-96808

Flatpak versions prior to 1.18.1 contain a symlink traversal vulnerability in the revokefs writer component, which is utilized by the flatpak-system-helper to process repository data from unprivileged callers. While the system rejects literal .. components, it fails to prevent traversal via symli...

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

PT-2026-97418

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.1 Description The revokefs writer, utilized by the flatpak-system-helper to receive repository data from unprivileged callers, fails to prevent symlink traversal despite rejecting literal .. components in file...

CVE-2026-96808: UNIX Symbolic Link (Symlink) Following

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-96808: UNIX Symbolic Link (Symlink) Following

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-52741 GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

EUVD-2026-83949

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

CVE-2026-52741

GoCD (continuous delivery server), versions 18.3.0 through 26.1.0 , is affected by a stored cross-site scripting vulnerability in its tracking-tool link generation. When a project uses a lenient Tracking Tool regular expression with an ID capturing group (e.g., JIRA-(.+)), an attacker with commit...

PT-2026-96131

Name of the Vulnerable Software and Affected Versions GoCD versions 18.3.0 through 26.0.0 Description Stored cross-site scripting occurs when the server generates unescaped tracking-tool links from commit comments. This happens when a project uses a lenient Tracking Tool regular expression with a...

CVE-2026-52741: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-.+. An attacker with commit access to a tracked material can...

CVE-2026-85706

CVE-2026-85706 GitLab CE および EE における未認証のパストラバーサル / 任意ファイル読み取り。 CVSS 10.0。ローカルラボの自己管理型 19.3.1 インスタンスに対して検証済み。 影響を受けるバージョン GitLab CE/EE: 18.7 から 19.1.7 まで 19.2.0 から 19.2.5 まで 19.3.0 から 19.3.1 まで 前提条件: インスタンスに少なくとも 1 つの公開プロジェクトが存在すること。任意の実在するプロジェクト id で動作する。アカウントやトークンは不要。 仕組み create-commit エンドポイント...

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

CVE-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4191-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4191-1 advisory. - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the...

Security update for python-GitPython

This update for python-GitPython fixes the following issues: CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...