PYSEC-2026-3838 GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Summary IndexFile.fromtree, IndexFile.reset → fromtree and IndexFile.mergetree append caller-influenced treeish strings positionally to git read-tree with no unsafe-option guard, no allowunsafeoptions parameter, and no -- separator. git read-tree --index-output= writes the resulting index to an...

PYSEC-2026-3839 GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Summary GitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist in git/remote.py:535 and check by Git.checkunsafeoptions git/cmd.py:963, the thing is this check him he is only call from fetch, pull, push and clonefrom, everything else who build a git argv fr...

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

SummaryGitPython already know that --upload-pack / --exec are command-exec vectors, they are denylist ingit/remote.py:535 and check by Git.checkunsafeoptions git/cmd.py:963, the thing is thischeck him he is only call from fetch, pull, push and clonefrom, everything else who build a gitargv from...

CVE-2026-88271

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...

EUVD-2026-75363

A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINESSDK versions 2.10 through 2.12.2 allows attackers to cause a denial of service process crash or potentially execute arbitrary code. The bridge decoder bridgedecoder.c trusts the packet length fiel...

CVE-2026-88271 GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...

EUVD-2026-75304

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...

CVE-2026-88271

GeoVision GV-LPC2211 V1.13 (and GV-LPC2011) is vulnerable to a Guest-level configuration overwrite via the SSVR service. A user with Guest privileges can overwrite the device configuration and replace the administrator password , effectively gaining full administrative control. The CNA-assigned C...

CVE-2026-88271 GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...

gzip security update

An update is available for gzip. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The gzip packages contain the gzip GNU zip data compression utility. gzip is use...

RLSA-2026:65998 Moderate: gzip security update

The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...

EUVD-2026-75186

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

PT-2026-89488

Summary The FTP auth-proxy driver stores one obscured password per username in a server-wide map. It does not bind the credential or returned VFS to the authenticated FTP session. If two accepted credentials use the same username but resolve to different proxy backends, the later login overwrites...

AlmaLinux 8 : gzip (ALSA-2026:65998)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:65998 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via global...

Unity Linux 20.1070a Security Update: gzip (UTSA-2026-107043)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107043 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS : HSQLDB vulnerability (USN-8735-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8735-1 advisory. It was discovered that HSQLDB incorrectly handled specially crafted database files. An attacker could...

Ubuntu 16.04 LTS : Gzip vulnerabilities (USN-8733-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8733-1 advisory. Micha Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable....

RockyLinux 8 : gzip (RLSA-2026:65998)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65998 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via global...

CVE-2026-88271: Missing Authorization

GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR...

CVE-2026-81540: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...