CVE-2026-77585

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...

CVE-2026-65099

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

EUVD-2026-66096

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-65099

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-65099

NVIDIA NemoClaw for Linux is vulnerable to an OS command injection in its command-line interface . A local attacker with low privileges and no user interaction can exploit this flaw to achieve code execution, data tampering, information disclosure, and denial of service (CVSS 7.8, HIGH). The CVSS...

CVE-2026-65099

NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

EUVD-2026-65962

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...

CVE-2026-77585

CVE-2026-77585 affects the Okta Privileged Access client , which fails to reject a leading hyphen in the username portion of an SSH target string. Because the value can be interpreted as a command-line option by the underlying SSH process, this constitutes an improper validation issue. Per the as...

GO-2026-6272 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit

Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement in github.com/axllent/mailpit...

curl: ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

cleanarg operates on char str, which is the UTF-8 copy allocated by converttchartoUTF8. It has no reference to the original wchart argv element. c / toolgetparam.c:632 / static void cleanargchar str / now that getstr has copied the contents of nextarg, wipe the next argument out so that the...

CVE-2026-59296

A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary...

GHSA-9557-234J-7RV9 Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-284h-m62q-gf8w. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting...

PYSEC-2026-3786

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

DEBIAN-CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

PYSEC-2026-3786

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676

GitPython versions before 3.1.59 are vulnerable to remote code execution via git-config injection. The root cause is unsafe re-serialization of multi-line git-config values during write operations: embedded newlines in quoted values are corrupted into live directives such as core.hooksPath . An a...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...