EUVD-2026-88376

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

Exploit for Path Traversal in Gitlab

CVE-2026-85706 GitLab unauthenticated arbitrary file read ★ C...

Continuous Assurance of Agentic Security Auditors for Software Delivery Decision Gates

Large language model LLM-based repository auditors are increasingly deployed as security controls within continuous integration CI pipelines, where their findings admit, block, or delay software changes. As Agentic Software Development Life Cycle SDLC Security Controls, their non-deterministic...

CVE-2026-97026: Creation of Temporary File With Insecure Permissions

Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask, other local users could read or modify the temporary directory used while installing apps or runtimes, potentially causing installation...

CVE-2026-97025: Creation of Temporary File With Insecure Permissions

Flatpak writes the OCI repository authentication token with world-readable permissions 0644 in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources e.g. as...

PT-2026-102379

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description Flatpak writes the OCI Open Container Initiative repository authentication token with world-readable permissions 0644 in the system-helper's cache directory. This allows other local users on ...

CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

DEBIAN-CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

UBUNTU-CVE-2026-96284

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96284

The Flatpak utility is vulnerable to a flaw where the OCI code paths in the system-helper context follow symlinks when importing OCI images. A malicious user who controls the OCI image can exploit this to gain arbitrary read-access to files within the flatpak-system-helper context, provided a sys...

EUVD-2026-88046

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-96284 Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

CVE-2026-96284: Improper Link Resolution Before File Access

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...

PT-2026-99724

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A malicious user can obtain read-access to files within the flatpak-system-helper context when a system OCI Open Container Initiative repository is configured. This occurs because the OCI cod...

CVE-2017-12561

This repository does not have a README...

CVE-2021-31805

This repository does not have a README...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...