CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CVE-2026-105764: Improper Control of Generation of Code

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-106219: External Control of File Name or Path

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

Access Denied for ListBuckets/GetBuckets on S3-Compatible Repositories

Challenge When adding an S3-compatible object storage repository to Veeam Backup & Replication, or during regular use of an existing one, Access Denied events related to a ListBuckets/GetBuckets operation may appear in the object storage system's access logs. These issues occur even though the...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

CVE-2026-105764

In versions prior to 3.2.4 , Immich (a self-hosted photo and video management solution) is vulnerable to Remote Code Execution (RCE) . An authenticated non-admin user can upload crafted SVG files that bypass the libvips native loader and fall through to ImageMagick coders. By using attacker-contr...

EUVD-2026-92868

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

Astra Linux – Vulnerability in Git

Gitk is a Tcl/Tk-based Git history browser. Starting with version 1.7.0, when a user clones an untrusted repository and runs Gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option “Support per-file encoding” must have been...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, before versions 2.2.24 and 2.7.7, the composer install command executed within a Git/HG repository with specially crafted branch names could lead to command injection. This required cloning untrusted repositories. Patches are available ...

Astra Linux – Vulnerability in Git

Git is a version control system. Before versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories containing submodules could be exploited through a bug in Git. This bug allowed a script to be written into the .git/ directory instead of the submodule’s worktree. This enabl...

PT-2026-106276

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.4, an authenticated non-admin user could upload SVG files that thumbnail-generation code in server/src/repositories/media.repository.ts passed to libvips. Files that bypassed libvips' native SVG loader fell...

AlmaLinux 9.2 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (ALMALINUX9.2:CLSA-2025:1737156361)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1737156361 advisory. - Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with...

Rocky Linux 8 [CIQ] Security Update: osbuild / osbuild-composer / osbuild-composer-core / etc (crlsa-2024_2961)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20242961 advisory. osbuild-composer: race condition may disable GPG verification for package repositories CVE-2024-2307 Tenable has extracted the preceding description block directly...

CLEANSTART-2026-DA21677 go command may execute unexpected commands when operating in untrusted VCS repositories

Security vulnerability affects the buildkitd package. The go command may execute unexpected commands when operating in untrusted VCS repositories...

CVE-2026-75101

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

EUVD-2026-84874

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

GHSA-3MQQ-HV9C-85HC wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

PT-2026-97047

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description An authorization bypass allows authenticated users to read the raw diff or patch of pull requests in private repositories. This occurs because access tokens for these resources are...