MAL-2026-11692 Malicious code in @or-sdk/files (npm)

npm/@or-sdk/files is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

MAL-2026-11728 Malicious code in @or-sdk/source-api (npm)

npm/@or-sdk/source-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11767 Malicious code in @ornikar/prismic-components (npm)

npm/@ornikar/prismic-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1782954031 TuxCare security update for hosted-git-info (1 CVE)

TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.7.1-tuxcare.1...

CLSA-2026-1774916743 TuxCare security update for parse-git-config (1 CVE)

TuxCare rebuilt parse-git-config to address 1 CVE. Fixed in 3.0.0-tuxcare.1...

CLSA-2026-1774398084 TuxCare security update for git-clone (5 CVEs)

TuxCare rebuilt git-clone to address 5 CVEs. Fixed in 0.1.0-tuxcare.1...

CLSA-2026-1773015270 TuxCare security update for hosted-git-info (1 CVE)

TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.1.4-tuxcare.1...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11120 – Command Injection via Git URL in CI/CD...

PT-2026-75235

TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.7.1-tuxcare.1...

PT-2026-78401

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description An arbitrary file overwrite issue exists in the IndexFile.from tree, IndexFile.reset, and IndexFile.merge tree methods. These methods append caller-influenced treeish strings to the git read-tree...

PT-2026-74118

TuxCare rebuilt git-clone to address 4 CVEs. Fixed in 0.1.0-tuxcare.1...

PT-2026-73893

TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.1.4-tuxcare.1...

Important: ansible-core

Issue Overview: A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provid...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.1 (AXSA:2026-1441:10)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1441:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

kernel security, bug fix, and enhancement update

6.12.0-211.42.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

PT-2026-74236

TuxCare rebuilt parse-git-config to address 1 CVE. Fixed in 3.0.0-tuxcare.1...

PT-2026-78403

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description A config-name injection issue exists in the option-name validator. This allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into optio...

SUSE CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-51190

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...