PYSEC-2026-3843 GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Summary The checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg...

PYSEC-2026-3836 GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

CLSA-2026-1789031241 TuxCare security update for 5 packages (1 CVE)

TuxCare rebuilt 5 packages to address 1 CVE. Fixed in 5.18.1-tuxcare.6...

CLSA-2026-1789029484 TuxCare security update for react-router (2 CVEs)

TuxCare rebuilt react-router to address 2 CVEs. Fixed in 6.30.3-tuxcare.1...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.70 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.70 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

ROOT-APP-NPM-CVE-2021-42740 CVE-2021-42740 in shell-quote - Patched by Root

Root has patched CVE-2021-42740 in the shell-quote package for Root:npm. Multiple fixed versions available...

EUVD-2026-75266

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CLEANSTART-2026-TD59374 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the haproxy-ingress package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references...

CLEANSTART-2026-BM73754 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the haproxy-ingress package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: polkit: polkit-127-5.1.hum1 aarch64, x8664 polkit-devel-127-5.1.hum1 aarch64, x8664 polkit-docs-127-5.1.hum1 noarch polkit-libs-127-5.1.hum1 aarch64, x8664 polkit-127-5.1.hum1.src src Security...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...

RLSA-2026:65887 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...

PT-2026-89416

Got another CVE CVE-2026-50808 with my co-worker! This time in @nopCommerce ! There is no released version with a fix, so please make sure you mitigate it until a fix is released! Read more here: https://t.co/FUtEAROFEE...

OPENSUSE-SU-2026:11742-1 google-guest-agent-20260903.01-1.1 on GA media

These are all security issues fixed in the google-guest-agent-20260903.01-1.1 package on the GA media of openSUSE Tumbleweed...

AlmaLinux 9 : perl-DBI (ALSA-2026:66179)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:66179 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...

Oracle Linux 10 : ELSA-2026-65887-0: / perl-DBI (ELSA-2026-658870)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-658870 advisory. 1.643-26.4 - Fix CVE-2026-19546: incomplete fix for CVE-2026-14380 in DBI::Profile Resolves: RHEL-236830 Tenable has extracted the preceding description bloc...

AlmaLinux 10 : perl-DBI (ALSA-2026:65887)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:65887 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...