11600 matches found
CVE-2026-44790
CVE-2026-44790 affects the n8n platform. An authenticated user with permission to create or modify workflows can inject CLI flags on the Git node’s Push operation, enabling reading of arbitrary files from the n8n server and potentially leading to full compromise. Public details confirm the issue ...
CVE-2026-44790 n8n: Arbitrary File Read via Git Node
n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows could inject CLI flags on the Git node's Push operation allowing an attacker to read arbitrary files from the n8n server potentially leadi...
CVE-2026-49465
Summary (CVE-2026-49465) : The n8n open source workflow automation platform before versions 1.123.48, 2.21.8, and 2.22.4 is affected. An authenticated user with permission to create or modify workflows could pass a local filesystem path as the source repository in the Git node’s Clone operation, ...
CVE-2026-49465 n8n: Git Node Clone and Push Operations Bypass File Sandbox
n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push...
Security update for docker-stable
This update for docker-stable fixes the following issues CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written outside of the BuildKit state directory bsc1260967. CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git...
GHSA-HCXC-WF8J-23HV vulnerabilities
Vulnerabilities for packages: grafana, grafana-fips, commercial-grafana...
Exploit for CVE-2020-11651
This is an updated verison original...
git-lfs security update
3.7.1-4 - Rebuild with new Golang - Resolves: RHEL-158765, RHEL-166675, RHEL-167677, RHEL-170838...
PT-2026-51578
Name of the Vulnerable Software and Affected Versions Daytona versions prior to 0.185.0 Description The daemon's git clone implementation disables TLS certificate verification. When a clone request includes Git credentials, the daemon transmits the HTTP Basic Authorization header to the remote...
PT-2026-51628
Name of the Vulnerable Software and Affected Versions Gogs affected versions not specified Description Gogs contains an authorization bypass in its Git Smart HTTP handler for repository RPCs. The system determines the authorization policy based on the client-supplied service query parameter rathe...
PT-2026-51630
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Git LFS storage is content-addressed by OID Object Identifier alone, while per-repository authorization is managed in the lfs object table. The serveUpload function skips the re-upload process when an...
GHSA-49P4-PX3H-RQ49 Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Impact When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. Patches Fixed in Buildah 1.44 and 1.43.2...
Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive
Impact When processing a build contexts or add/copy instructions, a malicious server serving a Git repository or a tar archive file can cause files outside of the build context directory to be included in the build context or copied into the build. Patches Fixed in Buildah 1.44 and 1.43.2...
GO-2026-5058 HashiCorp's go-getter library may allow arbitrary file reads in github.com/hashicorp/go-getter
HashiCorp's go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package...
CVE-2026-12888
An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90...
CVE-2026-12888 HTML injection in the Canarytoken Google Chat notification
An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90...
EUVD-2026-38240
An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90...
Key Exchange without Entity Authentication
Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to the SSH client not verifying remote host keys for git+ssh:// connections. An attacker can intercept and compromise mirrored repositories by performing man-in-the-middle attacks...
CVE-2026-11745
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...
CVE-2026-11745
A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...