CVE-2026-64881

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

CVE-2026-64879

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

CVE-2026-64881

CVE-2026-64881 involves an audit file upload handler that fails to sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. The CVSS scores indicate high impact to co...

CVE-2026-64879 Command Injection

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

CVE-2026-64879 Command Injection

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

CVE-2026-64879

Technical details about CVE-2026-64879 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-42325

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication...

Security Bulletin: This Power System update is being released to address CVE-2026-8058

Summary The BMC's diagnostic interface is affected. Vulnerability Details CVEID:CVE-2026-8058 DESCRIPTION: OPENBMC allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it. CWE:CWE-200: Exposure of Sensitive...

SUSE CVE-2026-64078

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: add and use xtablesunregistertableexit Previous change added xtablesunregistertablepreexit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that ...

CVE-2026-64879: Improper Neutralization of Special Elements used in an OS Command

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

PT-2026-63303

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an issue where the post-receive git hook handler incorrectly processes git push options on existing repositories. Users with owner or admin-collaborator access can use the...

PT-2026-62103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An issue exists in the audit file upload functionality where a filename provided during the upload process is not properly sanitized before being used in system...

CVE-2026-64881: Improper Neutralization of Special Elements used in an OS Command

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

PT-2026-62105

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The audit file upload handler fails to sanitize filenames, which allows shell metacharacters to be passed into system command execution. This input validation...

PT-2026-63263

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An incorrect authorization issue exists in the Machine Learning functionality. A management endpoint performs an insufficient authorization check by validating only a coarse privilege level...

CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the audit event search ORDER BY handling in JPAAuditEventDAO and Neo4jAuditEventDAO. An administrator with the right entitlements can execute arbitrary SQL by supplying crafted sort parameters in an audit-events...

SQL Injection

Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection through the...