CVE-2026-44189

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

CVE-2026-10671

creationtimestamp| type| source ---|---|--- 2026-07-22 04:40:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7izakmcz2n 2026-07-22 04:45:09+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mr7jaxlvqv2j...

CVE-2026-10573

creationtimestamp| type| source ---|---|--- 2026-07-22 04:39:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7iwgepat24 2026-07-22 04:39:25+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mr7iwpdmmd2g...

CVE-2026-62549

creationtimestamp| type| source ---|---|--- 2026-07-22 00:00:42+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mr6zecaaiq2o 2026-07-22 01:35:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr76nusrgg2a 2026-07-22 14:18:04+00:00| seen|...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via the workflow execution outputs. An attacker can access sensitive information by abusing limited feature...

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-63143 Missing Authorization in Kibana Leading to Unauthorized Information Disclosure

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-15957

creationtimestamp| type| source ---|---|--- 2026-07-21 22:09:29+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr6t5gpv222u 2026-07-21 23:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6y3aa3s22i 2026-07-22 13:13:56+00:00| seen|...

CVE-2026-8983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6smphxx22y 2026-07-21 22:08:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6t3pjvux23 2026-07-22 01:30:28+00:00| seen|...

EUVD-2026-41643

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...

CVE-2026-64877

creationtimestamp| type| source ---|---|--- 2026-07-21 19:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6lowlm3s2i 2026-07-21 20:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr6lxd6i4z2a 2026-07-21 23:47:46+00:00| seen|...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

EUVD-2026-46336

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

The CVE-2026-16493 entry describes a command-injection vulnerability in ansible-core where _extract_collection_from_git() builds git clone commands without a proper end-of-options separator, allowing an attacker to craft a collection source URI that injects payloads during ansible-galaxy collecti...

Arbitrary Argument Injection

Overview ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load...

EUVD-2026-46312

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15793

CVE-2026-15793 affects BuildKit-based workflows using the raw low‑level API. When a Git source is checked out with git.checkoutbundle=true, and the source is malicious, this can trigger a crafted command invocation on the host. Affected component: BuildKit custom frontends/clients (low‑level API ...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...