[SECURITY] Fedora 44 Update: GitPython-3.1.62-1.fc44

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

PT-2026-89589

Name of the Vulnerable Software and Affected Versions Forgejo versions prior to 16.0.4 Description Remote code execution is possible through the use of a crafted template repository. This occurs because the software mishandles template expansion on files located within the .forgejo/template...

PT-2026-89720

Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0...

CVE-2026-89094: Improper Neutralization of Special Elements Used in a Template Engine

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

Security update for libzypp, zypper (critical)

openSUSE security update: security update for libzypp, zypper ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21808-1 Rating: critical References: bsc1257249 bsc1271730 bsc1272534 bsc1273242 bsc1274091 bsc1274625 bsc1277790 Affected Products: openSU...

Joker linter executed project-local .jokerd/linter.* files during linting

Impact In Joker versions before 1.8.2, joker --lint located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could...

GHSA-M835-3CM9-RGGG Joker linter executed project-local .jokerd/linter.* files during linting

Impact In Joker versions before 1.8.2, joker --lint located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could...

SUSE-SU-2026:23547-1 Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection through Repo.init and isgitdir in git/repo/base.py and git/repo/fun.py. An attacker can execute arbitrary commands by supplying a repository...

SUSE-SU-2026:23731-1 Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Econf parser adds tags in drop-in files outside any section to main bsc1272534. - Need...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

SUSE-SU-2026:4096-1 Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

SUSE CVE-2026-22547

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values...

SUSE CVE-2026-25718

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths...

PT-2026-102994

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. Non security issues fixed: - Econf parser adds tags in drop-in files outside any section to main bsc1272534. - Need...

PT-2026-95868

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

PT-2026-102986

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

PT-2026-95817

This update for libzypp, zypper fixes the following issues: Security issue fixed: - invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. - hasCredentials requires both username AND password to be non-empty bsc1273242. - GPG Key hints in repoindex.xml...

CVE-2026-86995

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...