PT-2026-137191

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.5.0 through 0.40.8 Description In the nvm ls remote index tab, nvm remote version, and nvm ls cached functions, the requested version pattern is passed to grep as a bare argument without the -e flag. A .nvmr...

ghe-push-option-rce-scanner

CVE-2026-3854 — GitHub Enterprise Server RCE via Push Option Injection Overview Improper neutralization of push option values in GHE. Attacker with push access achieves RCE on the instance. Field| Value ---|--- CVE| CVE-2026-3854 Severity| CRITICAL Product| GitHub Enterprise Server CISA KEV|...

CVE-2026-3854-PoC

CVE-2026-3854 PoC — GitHub RCE via X-Stat Push Option Injection For educational and authorized security research purposes only. Do not use against any system without explicit written permission. Overview CVE-2026-3854 is a Remote Code Execution vulnerability in GitHub Enterprise Server's and...

CVE-2024-4577

CVE-2024-4577 Overview CVE-2024-4577 is a security vulnerability that affects PHP servers in the following versions: PHP 8.3.x 8.3.8 and earlier PHP 8.2.x 8.2.20 and earlier PHP 8.1.x 8.1.29 and earlier All versions prior to 8.0 Unsupported versions 7.x and 5.x This vulnerability is a remote code...

MGASA-2026-0556 Updated cifs-utils package fixes a security vulnerability

cifs-utils 4.2-7.8 mount-option injection in mount.cifs. CVE-2026-104715...

Updated cifs-utils package fixes a security vulnerability

cifs-utils 4.2-7.8 mount-option injection in mount.cifs. CVE-2026-104715...

CLSA-2026-1792928671 Fix CVE(s): CVE-2026-4786

SECURITY UPDATE: command-line option injection in webbrowser.open through a URL whose "%action" substitution yields a leading dash - debian/patches/CVE-2026-4519.patch: carries the fix, applied since tuxcare.els1: Lib/webbrowser.py UnixBrowser.open checks the URL after the %action substitution -...

CLSA-2026-1792790974 Fix CVE(s): CVE-2026-104715

SECURITY UPDATE: mount option injection via credentials file values - debian/patches/CVE-2026-104715.patch: in mount.cifs.c, reject username= and domain= values from a credentials file, and the USER environment variable or passwd login name, that contain an option delimiter comma, equals, CR or L...

OPENSUSE-SU-2026:22134-1 Security update for gh

This update for gh fixes the following issues: Changes in gh: - Update to version 2.102.0, fixing four security issues GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, GHSA-wjmr-j3rp-mh2g: gh release/run/attestation download and repo read-file --output could write to an unintended...

cifs-utils 7.6 Credentials File Option Injection

cifs-utils versions 7.0 through 7.6 contain a credentials-file option injection vulnerability that allows an unprivileged local user who controls a credentials file used by a privileged mount to inject mount options and execute files with root privileges. https://packetstorm.news/download/236052...

Exploit for CVE-2026-104715

CVE-2026-104715 cifs-utils credentials-file option injecti...

Improper Validation of Specified Type of Input

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via Git.lsremote forwarding caller-supplied URLs without checkunsafeprotocols validation. An attacker who controls the U...

EUVD-2026-101740

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

UBUNTU-CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857 GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

CVE-2026-110857: Improper Validation of Specified Type of Input

GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.lsremote forwards URLs without checkunsafeprotocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while...

dhcpoptinj

Inyector de opciones DHCP ¿Alguna vez has querido interceptar peticiones DHCP e insertar algunas opciones DHCP adicionales, sin que el remitente lo sepa? Probablemente no. Sin embargo, si alguna vez surge la necesidad, dhcpoptinj con suerte te ayudará. Por qué Puede haber muchas razones para...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver aws-efs-csi-driver v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the...