GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

SummaryIndexFile.fromtree, IndexFile.reset → fromtree and IndexFile.mergetree append caller-influenced treeish strings positionally to git read-tree with no unsafe-option guard, no allowunsafeoptions parameter, and no -- separator. git read-tree --index-output= writes the resulting index to an...

PYSEC-2026-3843 GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Summary The checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg...

PYSEC-2026-3838 GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Summary IndexFile.fromtree, IndexFile.reset → fromtree and IndexFile.mergetree append caller-influenced treeish strings positionally to git read-tree with no unsafe-option guard, no allowunsafeoptions parameter, and no -- separator. git read-tree --index-output= writes the resulting index to an...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4Component: gitpython-developers/GitPython PyPI: GitPythonAffected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

CVE-2026-78361

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

EUVD-2026-75265

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

CVE-2026-77770

The miniOrange 2FA WordPress plugin (versions before 6.3.1 and before 19.3 ) is vulnerable to unauthenticated arbitrary option deletion . The root cause is the lack of a validated transaction before deleting site options based on unauthenticated request input. An attacker can exploit this by send...

CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-78361 zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

CVE-2026-78361

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin, in versions prior to 2.4.0 , is vulnerable to unauthenticated arbitrary option deletion . This is caused by a lack of authorization checks on one of the plugin's front-end request handlers and a failure to restrict the option ...

WordPress Notiqoo plugin < 1.4.14 - Contributor+ Arbitrary Option Update vulnerability

Contributor+ Arbitrary Option Update vulnerability discovered by Seongwon Lee in WordPress Plugin Notiqoo – Order Notification & Customer Chat for WooCommerce versions 1.4.14...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-19840

The Notiqoo WordPress plugin (specifically the Order Notification & Customer Chat for WooCommerce plugin) versions before 1.4.14 is vulnerable to an incorrect authorization flaw. The plugin fails to perform adequate capability checks on several of its AJAX actions and constructs the name of the o...

CLEANSTART-2026-KP10631 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Multiple security vulnerabilities affect the vault-k8s package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for...

PT-2026-89290

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

PT-2026-89521

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

PT-2026-89293

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

PT-2026-89476

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description When using backend/local with the --links flag or links=true configuration, symlink targets are exposed as .rclonelink objects. A flaw exists where fs.RangeOption.Decode can pass an unchecked positiv...