CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

OPENSUSE-SU-2026:21584-1 Security update for git-cliff

This update for git-cliff fixes the following issues: Changes in git-cliff: - Update to version 2.13.1: Support more configuration file locations Add per-commit statistics Expose determined bump type in release context Add configurable commit processing order Add environment variable for offline...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

EUVD-2026-58685

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

The CVE affects Eclipse Theia up to v1.69.0, where opening a folder can trigger source control integration and run git commands (e.g., git status) without user trust. A repository-local .git/config containing core.fsmonitor or similar settings can cause arbitrary commands to execute with the user...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-73621

A flaw was found in GitPython. An argument injection vulnerability in the Commit.count method allows an attacker to control options passed to the method. By supplying a crafted output option, an attacker can cause the git rev-list command to truncate an arbitrary file to zero bytes. This enables...

CVE-2026-73622

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler-fips, aws-iam-authenticator-fips, packer-fips, pgpool2exporter, etcd-fips, stampdalf, tfsec, kubeflow-katib, direnv, protoc-gen-go, ini-file, wgcf, vertical-pod-autoscaler, kapp-controller-fips, dragonfly-operator-fips,...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler-fips, aws-iam-authenticator-fips, packer-fips, pgpool2exporter, etcd-fips, stampdalf, tfsec, kubeflow-katib, direnv, protoc-gen-go, ini-file, wgcf, vertical-pod-autoscaler, kapp-controller-fips, dragonfly-operator-fips,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: runc, crossplane-provider-aws-s3, gitness, terraform-docs, actions-runner-controller, kubernetes-csi-driver-nfs, litestream, cluster-api-ipam-provider-in-cluster, tfsec, mods, helm-operator, sriov-network-device-plugin, s5cmd, pvc-autoresizer, cert-manager-cmctl, kin...

CVE-2026-47191: Improper Verification of Cryptographic Signature

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

PT-2026-72042

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.70.0 Description Opening a folder in applications built on Theia that include git integration, such as the Theia IDE, triggers source control integration without requiring the user to trust the folder first. T...

CVE-2026-19884: Inclusion of Functionality from Untrusted Control Sphere

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

PT-2026-72121

Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...

Linux Distros Unpatched Vulnerability : CVE-2026-73625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options...