EUVD-2026-78001

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2025-24890

A flaw was found in gix-sec. On Windows, an elevated administrator running a program that uses gix-sec may incorrectly trust repositories controlled by another user. This bypasses security protections, allowing repository configurations or hooks to execute commands with the administrator's...

CVE-2025-24890

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

AZL-100953 CVE-2025-24890 affecting package rust 1.75.0-31

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

AZL-100956 CVE-2025-24890 affecting package rust 1.96.1-1

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

EUVD-2025-210908

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

CVE-2025-24890 gix-sec safe.directory protections absent for elevated administrators

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-sec/src/identity.rs,...

Astra Linux – Vulnerability in grub2

The GRUB2’s shimlock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such files to be loaded may lead to unverified code and modules being loaded in GRUB2, thereby breaking the secure boot trust-chain...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux - Vulnerability in Golang-1.19

The ParseAddressList function improperly handles comments text within parentheses within display names. Since this contradicts conforming address parsers, it can lead to different trust decisions being made by programs that use different parsers...

Astra Linux – Vulnerability in Intel Microcode

In the memory subsystem of certain IntelR XeonR 6 processors, out-of-bounds writing when using IntelR SGX or IntelR TDX may allow a privileged user to potentially enable privilege escalation through local access...

CVE-2026-85195

Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla 20.0.0 - Articles Anywhere accepts link options such as onclick and onmouseover. In affected versions, those options become real HTML event attributes without checking the article...

CVE-2026-90651

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When api_ssl_verify and upstream_ssl_verify are omitted from socket.yml, the generated OpenResty/Lua HTTP client accepts any certificate without chain validatio...

CVE-2026-90553

A flaw was found in vLLM. The LlavaOnevision2 processor loader incorrectly ignores the trustremotecode parameter, which is designed to prevent the execution of untrusted code. This oversight allows an attacker to craft a malicious model containing arbitrary code. When such a model is loaded, the...

PT-2026-90658

🚨High - vLLM RCE via LlavaOnevision2 trust remote code Bypass CVE-2026-90553 vLLM’s LlavaOnevision2 processor loader ignores trust remote code=False when loading remote processor classes, allowing a malicious model to ship code in processing llava onevision2.py that executes during processor...

CVE-2026-54248

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-54248 Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-54248 Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify tha...

CVE-2026-54248

Doco-CD , a GitOps continuous delivery tool for Docker Compose projects and Swarm stacks, contains an OCI trust-policy bypass prior to version 0.90.1 . A trust-boundary flaw allowed artifact-provided .doco-cd.yml configuration (with oci.verify: false) to override the global OCI_TRUST_POLICY, caus...

Fedora 44 : curl (2026-f26b509a1a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f26b509a1a advisory. - Fix HTTP/2 stream-dependency tree UAF CVE-2026-10536 - Fix Native CA trust persist CVE-2026-11564 - Fix stale proxy password leak CVE-2026-9079 -...