EUVD-2026-94407

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92415: Use of Externally-Controlled Input to Select Classes or Code

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

Unity Linux 20.1070e Security Update: python-filelock (UTSA-2026-099470)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099470 advisory. filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition allows local attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-73621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the...

DEBIAN-CVE-2026-73621

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

CVE-2026-73621

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

CVE-2026-73621

GitPython vulnerability CVE-2026-73621 affects GitPython before 3.1.56. The Commit.count() method forwards keyword arguments to git rev-list without the check_unsafe_options guard present in iter_items, allowing an attacker who controls options (e.g., via an app forwarding a user-supplied dict) t...

CVE-2026-73621 GitPython before 3.1.56 Arbitrary File Truncation via Commit.count

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

Summary Commit.count forwards kwargs into revlist with no checkunsafeoptions guard the guard exists only in the sibling iteritems, commit.py:341. git rev-list --output= opens and truncates the target file to 0 bytes before revision parsing, so countoutput='/victim' destroys/blanks an arbitrary...

PT-2026-88181

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-956x-8gvw-wg5v. This link is maintained to preserve external references. Original Description GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and...

CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise

In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls,...

SUSE Linux Enterprise Server security vulnerabilities

SUSE Linux Enterprise Server is an enterprise server edition of the Linux operating system from SUSE Germany. A security vulnerability in grub-once in grub2 in SUSE Linux Enterprise Server 15 SP4, which originates in openSUSE Factory, allows a local attacker to truncate arbitrary files. This issu...