boofuzz

.. image:: https://github.com/jtpereyda/boofuzz/raw/master/artwork/boo-logo-dark.svg :width: 60% :alt: boofuzz logo boofuzz: Network Protocol Fuzzing for Humans .. image:: https://github.com/jtpereyda/boofuzz/actions/workflows/test.yml/badge.svg?branch=master :target:...

CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Timezone Abbreviation Heap Buffer Overflow PostgreSQL tochar function has a heap buffer overflow vulnerability when handling timezone formatting. By setting an overly long POSIX timezone abbreviation, an attacker can trigger an out-of-bounds write to a fixed...

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

NPM: simple-git: unsafe-operations plugin bypass via git long-option abbreviation --receive-p/--exe - command execution residual of CVE-2026-28291 vulnerability discovered by ? in WordPress Npm simple-git versions = 3.36.0...

GHSA-858H-WHJF-MVG5 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git's blockUnsafeOperationsPlugin blocks dangerous git options --upload-pack/--receive-pack/--exec/... unless the consumer opts in via unsafe:allowUnsafePack:true. Detection @simple-git/argv-parser detectVulnerableFlags matches the parsed flag NAME against literal-spelling patterns:...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1787648234)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1787648234 advisory. - A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the...

AlmaLinux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1787649624)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787649624 advisory. - Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating syst...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827

The simple-git Node.js interface for Git operations is vulnerable to command injection in versions prior to 4.0.0 . The root cause is that the blockUnsafeOperationsPlugin only compares option names against literal dangerous spellings, failing to account for Git's support for unambiguous long-opti...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spellings while Git accepts unambiguous...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...