CVE-2026-70375 HashBrown CMS: OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.execgit checkout $this.branch || 'master', interpolating the configured branch value directly into...

CVE-2026-70375

CVE-2026-70375 : HashBrown CMS <1.4.6 has an OS Command Injection in the Git deployer. GitDeployer.pullRepo() runs AppService.exec(git checkout ${this.branch || 'master'}) with the branch value interpolated directly, and GitDeployer.validate() only rejects a single quote in repo/branch/usernam...

CVE-2026-10569 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

CVE-2026-10569

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy are affected by CVE-2026-10569 due to exposure of sensitive information in plugin output logs. Affected products/versions: UCD 7.2–7.2.3.23; 7.3–7.3.2.18; DevOps Deploy 8.0–8.0.1.13; 8.1–8.1.2.6; 8.2–8.2.1.0. Root cause: plugin output logs may reve...

EUVD-2026-51275

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

CVE-2026-12702

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

EUVD-2026-48531

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

CVE-2026-12702

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

CVE-2026-12702

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

CVE-2026-12702

CVE-2026-12702 affects Octopus Deploy. The issue stems from insufficient checks on project trigger actions, enabling an unauthorized user to trigger a deployment. The description notes this occurs in “affected versions” but does not specify exact versions or products beyond Octopus Deploy, nor pr...

PT-2026-64262

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

MAL-2026-11028 Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to multiple Netty vulnerabilities (CVE-2026-45673, CVE-2026-45674, CVE-2026-47691)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45673, CVE-2026-45674, CVE-2026-47691. Vulnerability Details CVEID:CVE-2026-45673 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)

Summary Netty is used by IBM UrbanCode Deploy UCD for network communication. CVE-2026-45416. Vulnerability Details CVEID:CVE-2026-45416 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

CVE-2026-47394

CVE-2026-47394 describes an unauthenticated file-read vulnerability in PraisonAI’s MCP server. The issue stems from a dispatcher in server.py that enforces no strict schema on JSON arguments fed to handlers (via kwargs ), allowing tools like workflow.show, workflow.validate, and deploy.validate t...

CVE-2026-47394 PraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in mcpserver/adapters/clitools.py. Commit 68cc9427 "fixsecurity: harden MCP rules path handling…" adde...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...