116315 matches found
CVE-2026-44517
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
CVE-2026-44517
Buildah (OCI image building tool) versions 1.38.1 through 1.43.2 and 1.44.0 are vulnerable to a build context breakout . The root cause is that TempDirForURL in define/types.go fails to securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory/stdinTo...
CVE-2026-44517
Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...
CVE-2026-45099
Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...
CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...
CVE-2026-62960
Git for Windows prior to 2.55.0.windows.4 is vulnerable to a security bypass in bundle-uri.c . When transfer.bundleuri=true, a malicious remote Git server can advertise a bundle URI processed by transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). Non-HTTP(S) va...
CVE-2026-54071
BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...
CVE-2026-58211
A flaw was found in NATS Server, a high-performance messaging system. This vulnerability allows a client to bypass normal authentication and connection restrictions by registering as a "noauthuser" through a specific parser path. This occurs when the client's initial operation is not a standard...
CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...
EUVD-2026-64058
BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...
CVE-2026-54071
BabelDOC (a document translation tool) prior to 0.6.3 is vulnerable to arbitrary code execution via untrusted pickle deserialization in CMapDB._load_data() (babeldoc/pdfminer/cmapdb.py). A crafted PDF can embed a hex-encoded absolute path in its /Encoding or CMapName field (e.g., /#2Ftmp#2Fevil),...
CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...
CVE-2026-71493
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...
CVE-2026-62675
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path...
CVE-2026-62677
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...
EUVD-2026-64035
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...
CVE-2026-71493 Infracost: Arbitrary file read via config-template readFile symlink traversal
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...