CVE-2026-63728

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

PT-2026-67302

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.52 Description GitPython is susceptible to environment-variable exfiltration when using the Repo.clone from function. The issue occurs because the remote URL provided by the user is processed by the Git.polish u...

PT-2026-61936

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists in the handling of ProxyCommand where a malicious username expanded through the %r variable can inject shell metacharacters. This can lead to the exposure of environment variable...

CVE-2026-63728

Gitleaks before version 8.30.1 is affected by a template injection vulnerability in the report template feature. Attackers who can supply or influence report templates can leverage non-hermetic Sprig template functions (env, expandenv, getHostByName) to read arbitrary environment variables and ex...

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

CVE-2026-63728

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

CVE-2026-44508

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate...

BIT-NGINX-GATEWAY-2026-42533 NGINX Map directive and Regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

CVE-2026-44508

Removed by vendor...

CVE-2026-44508

CVE-2026-44508 is rejected; this candidate is a duplicate of CVE-2026-43618 and should not be used.

MAL-2026-10927 Malicious code in roles-royce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...

Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

MAL-2026-10869 Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

PT-2026-61746

Name of the Vulnerable Software and Affected Versions Gitleaks versions prior to 8.30.1 Description A template injection issue exists where attackers who can supply or influence report templates can read arbitrary environment variables and exfiltrate sensitive data. This is achieved by leveraging...

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...