3773 matches found
PYSEC-2026-3809 asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...
asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution
Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Summarywebcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
SummaryThe checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg emi...
PYSEC-2026-3843 GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
Summary The checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg...
GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...
PYSEC-2026-3836 GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...
CVE-2026-81431
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...
EUVD-2026-75266
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...
CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...
CLEANSTART-2026-TD59374 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
Multiple security vulnerabilities affect the haproxy-ingress package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references...
CLEANSTART-2026-BM73754 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
Multiple security vulnerabilities affect the haproxy-ingress package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references...
perl-DBI security update
An update is available for perl-DBI. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...
RLSA-2026:65887 Important: perl-DBI security update
DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...
RockyLinux 10 : perl-DBI (RLSA-2026:65887)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65887 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...
PT-2026-89390
Name of the Vulnerable Software and Affected Versions Traefik versions 1.x Traefik versions 2.x through 2.11.55 Traefik versions 3.0.0 through 3.7.11 Description Traefik handles request header canonicalization only on dashes, meaning it treats headers like X-Auth-User, X Auth User, and X.Auth.Use...
AlmaLinux 10 : perl-DBI (ALSA-2026:65887)
The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:65887 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...
AlmaLinux 9 : perl-DBI (ALSA-2026:66179)
The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:66179 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the preceding...
PT-2026-89294
The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...
