Lucene search
+L

8309 matches found

NVD
NVD
added 2026/07/21 12:17 a.m.13 views

CVE-2026-63728

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

8.1CVSS0.00145EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.8 views

PT-2026-67302

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.52 Description GitPython is susceptible to environment-variable exfiltration when using the Repo.clone from function. The issue occurs because the remote URL provided by the user is processed by the Git.polish u...

8.7CVSS5.5AI score0.00266EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.6 views

PT-2026-61936

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists in the handling of ProxyCommand where a malicious username expanded through the %r variable can inject shell metacharacters. This can lead to the exposure of environment variable...

3.9CVSS5.8AI score0.00115EPSS
SaveExploits0References37
CVE
CVE
added 2026/07/20 11:32 p.m.26 views

CVE-2026-63728

Gitleaks before version 8.30.1 is affected by a template injection vulnerability in the report template feature. Attackers who can supply or influence report templates can leverage non-hermetic Sprig template functions (env, expandenv, getHostByName) to read arbitrary environment variables and ex...

8.1CVSS5.6AI score0.00145EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/20 11:32 p.m.5 views

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

8.1CVSS5.6AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/20 11:32 p.m.5 views

CVE-2026-63728

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

8.1CVSS5.5AI score0.00145EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/20 11:32 p.m.39 views

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

8.1CVSS0.00145EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/20 10:20 p.m.10 views

GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

6.9CVSS5.5AI score0.00291EPSS
SaveExploits0References8
NVD
NVD
added 2026/07/20 9:16 p.m.8 views

CVE-2026-44508

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate...

0.00274EPSS
SaveExploits0
OSV
OSV
added 2026/07/20 8:45 p.m.5 views

BIT-NGINX-GATEWAY-2026-42533 NGINX Map directive and Regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

9.2CVSS6.6AI score0.03596EPSS
SaveExploits5References2
Debian CVE
Debian CVE
added 2026/07/20 8:30 p.m.8 views

CVE-2026-44508

Removed by vendor...

5.2AI score0.00274EPSS
SaveExploits0
CVE
CVE
added 2026/07/20 8:30 p.m.21 views

CVE-2026-44508

CVE-2026-44508 is rejected; this candidate is a duplicate of CVE-2026-43618 and should not be used.

5.7AI score0.00274EPSS
SaveExploits0
OSV
OSV
added 2026/07/20 5:53 p.m.6 views

MAL-2026-10927 Malicious code in roles-royce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...

5.8AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/20 9:12 a.m.24 views

Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

5.6AI score
SaveExploits0References3
OSV
OSV
added 2026/07/20 9:12 a.m.10 views

MAL-2026-10869 Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

5.6AI score
SaveExploits0References3
OSV
OSV
added 2026/07/20 12:0 a.m.4 views

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

5.7AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/20 12:0 a.m.7 views

PT-2026-61746

Name of the Vulnerable Software and Affected Versions Gitleaks versions prior to 8.30.1 Description A template injection issue exists where attackers who can supply or influence report templates can read arbitrary environment variables and exfiltrate sensitive data. This is achieved by leveraging...

8.1CVSS5.9AI score0.00145EPSS
SaveExploits0References10
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/20 12:0 a.m.15 views

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

5.7AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/19 3:40 p.m.32 views

CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

0.00172EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/07/19 3:40 p.m.31 views

CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

0.0018EPSS
SaveExploits0References7
Rows per page
Query Builder