CVE-2026-44191 Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

CVE-2026-44191

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

PT-2026-63477

Name of the Vulnerable Software and Affected Versions mongod affected versions not specified Description An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command. This leads to a denial of service for all connect...

Oracle Linux 10 : golang (ELSA-2026-29980)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-29980 advisory. 1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1 1.25.5-1 -...

CVE-2026-12968: Improper Neutralization of Input During Web Page Generation

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

PT-2026-63374

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability CWE-78 arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell...

PT-2026-71452

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description An arbitrary file overwrite issue exists in the Diffable.diff method due to insufficient validation of git options passed through kwargs. An attacker can use the --output argument via the other...

PT-2026-71453

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description A remote code execution issue exists in the check unsafe options guard. This guard can be bypassed by smuggling git options within single-character kwarg values. An attacker can provide crafted...

Gitea: Repository Visibility Manipulation via Git Push Options

Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

GHSA-8P9H-49RC-QGXJ Gitea: Repository Visibility Manipulation via Git Push Options

Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Summary GitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist in git/remote.py:535 and check by Git.checkunsafeoptions git/cmd.py:963, the thing is this check him he is only call from fetch, pull, push and clonefrom, everything else who build a git argv fr...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Repo.archive, Repo.itercommits, Repo.blame, and Git.lsremote call paths in git/repo/base.py, git/objects/commit.py, and git/cmd.py...

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

Incomplete List of Disallowed Inputs

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through Git.checkunsafeoptions in git/cmd.py. An attacker can execute arbitrary commands by supplying abbreviated unsafe option...

Command Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the canonicalizeoptionname function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as...

GitPython unsafe clone option gate bypass through joined short options

GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...