Lucene search
+L

11565 matches found

UbuntuCve
UbuntuCve
added 2026/08/25 2:16 a.m.15 views

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

9.8CVSS6.3AI score0.00426EPSS
SaveExploits1References5
Cvelist
Cvelist
added 2026/08/25 1:30 a.m.47 views

CVE-2026-78678 GitPython before 3.1.59 Arbitrary File Read via Repo.blame()

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

7.1CVSS0.0024EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/08/25 1:30 a.m.41 views

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

8.7CVSS0.0043EPSS
SaveExploits1References2
OSV
OSV
added 2026/08/25 1:30 a.m.26 views

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

8.7CVSS5.8AI score
SaveExploits0References4
AlpineLinux
AlpineLinux
added 2026/08/25 1:30 a.m.10 views

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

8.7CVSS7.2AI score0.0043EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.21 views

PT-2026-81352

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS Command Injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist of executables defined in security.yaml, whic...

8.4CVSS6.2AI score0.00193EPSS
SaveExploits0References8
Tenable Nessus
Tenable Nessus
added 2026/08/25 12:00 a.m.12 views

JetBrains TeamCity < 2025.11.6 / 2026.x < 2026.1.2 Code Execution (CVE-2026-65907)

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.6, or prior to 2026.1.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible CVE-2026-65907 Note that Nessus has not tested...

9.1CVSS6AI score0.00421EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/25 12:00 a.m.11 views

Linux Distros Unpatched Vulnerability : CVE-2026-78677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone...

8.7CVSS7.1AI score0.0043EPSS
SaveExploits1References2
CISA KEV Catalog
CISA KEV Catalog
added 2026/08/25 12:00 a.m.32 views

Gitea Code Injection Vulnerability

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account...

9.8CVSS9AI score0.86777EPSS
SaveIn wildExploits14
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.15 views

awx: webhook status callback SSRF leaks the Git PAT

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

7.7CVSS5.8AI score0.00448EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.11 views

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

8.8CVSS8.6AI score0.01854EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.16 views

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

8.6CVSS8.3AI score0.01037EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.14 views

gitpython: GitPython: Arbitrary Code Execution via Joined Short Options Bypass

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

9.8CVSS8.8AI score0.0038EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/08/24 4:36 p.m.22 views

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

8.6CVSS8.3AI score0.01037EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/08/24 4:36 p.m.13 views

gitpython: GitPython: Arbitrary Code Execution via Joined Short Options Bypass

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

9.8CVSS8.8AI score0.0038EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/08/24 4:36 p.m.27 views

awx: webhook status callback SSRF leaks the Git PAT

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

7.7CVSS5.8AI score0.00448EPSS
SaveExploits0References4
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in Git

Git is a version control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that were longer than 1024 characters could be used to exploit a bug in...

7.8CVSS8AI score0.06079EPSS
SaveExploits2References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in Git

Git is an open-source, scalable, distributed revision control system. git shell is a restricted login shell that can be used to implement Git’s push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits comman...

8.8CVSS7.6AI score0.03259EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.11 views

Astra Linux – Vulnerability in Git

Git is a distributed revision control system. The gitattributes command allows for the definition of attributes for certain file paths. These attributes can be defined by adding a .gitattributes file to the repository, which contains a set of file patterns and the attributes that should be applie...

9.8CVSS7.2AI score0.56334EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.8 views

Astra Linux – Vulnerability in python-pip

A flaw was discovered in python-pip regarding its handling of Unicode separators in git references. A remote attacker could potentially exploit this issue to install a different revision in a repository. The greatest threat posed by this vulnerability is to data integrity. This issue has been fix...

5.7CVSS6.7AI score0.01829EPSS
SaveExploits2References2
Rows per page
Query Builder