11565 matches found
CVE-2026-19884
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...
CVE-2026-19884
The CVE affects Eclipse Theia up to v1.69.0, where opening a folder can trigger source control integration and run git commands (e.g., git status) without user trust. A repository-local .git/config containing core.fsmonitor or similar settings can cause arbitrary commands to execute with the user...
EUVD-2026-58685
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...
CVE-2026-19884
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...
CVE-2026-73621
A flaw was found in GitPython. An argument injection vulnerability in the Commit.count method allows an attacker to control options passed to the method. By supplying a crafted output option, an attacker can cause the git rev-list command to truncate an arbitrary file to zero bytes. This enables...
CVE-2026-73622
A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...
GO-2025-4013 vulnerabilities
Vulnerabilities for packages: beats-fips, gke-gcloud-auth-plugin, neuvector-dbgen-fips, age, restic-fips, kubernetes-event-exporter-fips, prometheus-postgres-exporter, capslock, grpcurl-fips, argo-rollouts-fips, external-secrets-operator-fips, gobuster, sriov-network-device-plugin,...
GO-2025-4009 vulnerabilities
Vulnerabilities for packages: beats-fips, gke-gcloud-auth-plugin, neuvector-dbgen-fips, age, restic-fips, kubernetes-event-exporter-fips, prometheus-postgres-exporter, capslock, grpcurl-fips, argo-rollouts-fips, external-secrets-operator-fips, gobuster, sriov-network-device-plugin,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: ctop, kuberlr, kubo, tofu-controller, sftpgo-plugin-pubsub, yace, external-dns, lvm-driver, chisel, ksops, osv-scanner, vale, flux-kustomize-controller, crossplane-provider-aws-s3, scorecard, blobfuse2, gke-gcloud-auth-plugin, kubernetes-replicator, rancher-telemetry...
Linux Distros Unpatched Vulnerability : CVE-2026-73623
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command executio...
PT-2026-72042
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...
PT-2026-72121
Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...
Linux Distros Unpatched Vulnerability : CVE-2026-73625
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73840
OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...