CVE-2026-58508

The Git repository management system Gitea contains two Server-Side Request Forgery (SSRF) vulnerabilities within its migration and mirror functions. The root causes are identified as DNS rebinding and a lack of re-validation , which may allow a remote attacker to induce the server to make unauth...

CVE-2026-58508 Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

PT-2026-71702

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Two Server-Side Request Forgery SSRF issues exist in the migration and mirror functions. These involve DNS rebinding and a lack of re-validation, which could allow an attacker to induce the...

CVE-2026-58508: Improper Access Control

Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...

CVE-2026-16956

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16956 IBM Db2 Mirror for i is vulnerable to OS command injection []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-57380

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16956 IBM Db2 Mirror for i is vulnerable to OS command injection []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16956

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-16956 due to improper neutralization of special elements used in an OS command, enabling remote command execution. The vulnerability impacts IBM Db2 Mirror for i running these versions and is rated CVSS v3.1 base score 9.8 (...

CVE-2026-16956: Improper Neutralization of Special Elements used in an OS Command

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

PT-2026-71185

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities

Summary The IBM Db2 Mirror for i GUI is affected by multiple vulnerabilities CVE-2026-17186, CVE-2026-17184, CVE-2026-17182, CVE-2026-17181, CVE-2026-16879, CVE-2026-17179, CVE-2026-16915, CVE-2026-17175, CVE-2026-18554, CVE-2026-17079, CVE-2026-16905, CVE-2026-17227, CVE-2026-17209,...

Security Bulletin: IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror [CVE-2026-16961]

Summary IBM i is vulnerable to Structure Query Language SQL injection as a result of processing specially crafted statements CVE-2026-16961 in Db2 Mirror as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16961 DESCRIPTION: IBM i is vulnerable to SQL injection...

Security Bulletin: IBM Db2 Mirror for i is vulnerable to OS command injection [CVE-2026-16956]

Summary IBM Db2 Mirror for i is vulnerable to OS command injection as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16956 DESCRIPTION: IBM Db2 Mirror for i could allow a remote attacker to execute arbitrary commands due to improper neutralization of special...

MAL-2026-12894 Malicious code in bnpl-blocks-atom-bnpl-small-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c774d6998dfe3f37ec23c527ddb5dee44c7448c88d5f059905ed3b6ef04959c index.js unconditionally requires helpers.js on module load. helpers.js reconstructs mirror hostnames from split string fragments e.g...

MAL-2026-12433 Malicious code in saas-f-lego-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...

CVE-2026-18376

Koji's SCM URL parser normalizes repository paths using urllib.parse.urlparse and os.path.normpath before evaluating them against the configured SCM policy. Because normpath decodes percent-encoded sequences at policy-check time but the underlying Git HTTP transport decodes them again during fetc...

SUSE CVE-2026-52801

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddres...

SUSE CVE-2026-52808

Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints - PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync - are gated by reqRepoWriter rather than reqRepoAdmin. The equivalent...

Security Bulletin: IBM Db2 Mirror for i is affected by multiple vulnerabilities due to Angular [CVE-2026-50170, CVE-2026-50171, CVE-2026-54266, CVE-2026-54268, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267, CVE-2026-54265]

Summary The IBM Db2 Mirror for i GUI uses the Angular web framework. The version of Angular used by IBM Db2 Mirror for i is vulnerable to leaking information by transferring cache state to the client-side application CVE-2026-50170 and using a weak hash function for the server-side cached respons...