AlmaLinux 9.2 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (ALMALINUX9.2:CLSA-2025:1756929133)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1756929133 advisory. - Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additiona...

CentOS Linux 6 [TuxCare] Security Update: emacs-git / emacs-git-el / git / git-all / git-cvs / git-daemon / etc (CENTOS6:CLSA-2025:1754381382)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1754381382 advisory. - Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional...

Linux Distros Unpatched Vulnerability : CVE-2026-62364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.in...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364

The wlc Weblate command-line client is vulnerable to unauthorized API token disclosure in versions prior to 2.0.1 . If an unscoped API token is provided via WLC_KEY or --key without an explicit WLC_URL or --url, the application may automatically use a project-configured URL from files like .webla...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

PT-2026-97036

Name of the Vulnerable Software and Affected Versions wlc versions prior to 2.0.1 Description The command-line client can send an unscoped API token to an attacker-controlled server when executed within an untrusted repository, pull request checkout, or a directory containing untrusted ancestor...

CVE-2026-62364: Exposure of Sensitive Information to an Unauthorized Actor

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

Astra Linux – Vulnerability in Git

Git GUI allows you to use Git source control management tools through a graphical interface. When a user clones an untrusted repository and is tricked into editing a file located in a directory with a malicious name in the repository, Git GUI can create and overwrite files for which the user has...

Joker linter executed project-local .jokerd/linter.* files during linting

Impact In Joker versions before 1.8.2, joker --lint located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could...

GHSA-M835-3CM9-RGGG Joker linter executed project-local .jokerd/linter.* files during linting

Impact In Joker versions before 1.8.2, joker --lint located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could...

Arbitrary Code Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Code Injection through Repo.init and isgitdir in git/repo/base.py and git/repo/fun.py. An attacker can execute arbitrary commands by supplying a repository...

PT-2026-85567

Name of the Vulnerable Software and Affected Versions aider versions 0 through 0.86.2 Description The software automatically loads a .aider.conf.yml configuration file from the root of the git repository where it is launched. An attacker can craft a repository containing a malicious configuration...

CVE-2026-84361

A flaw was found in Composer. A malicious dependency package from a custom Composer repository or an untrusted composer.lock file could exploit a vulnerability in how Composer handles Perforce source URLs. By setting source.type to perforce and source.url to an rsh: or jsh: P4PORT value, an...

CVE-2026-19590

OpenAI Codex Desktop for Windows and macOS is vulnerable to arbitrary code execution due to a lack of proper sanitization of configuration settings. Specifically, automated Git operations trust the repository's local core.hooksPath setting. An attacker can provide a specially crafted repository w...

SUSE CVE-2026-49145

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...