openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21793-1)

"The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21793-1 advisory. Changes in hauler: - update to 2.1.0 bsc1265425, CVE-2026-41888: v2.1.0 is a minor release built on the containerd- native foundation laid down...

RHEL 9 : image-builder (RHSA-2026:65886)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65886 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes:...

CVE-2026-87063

A flaw was found in konflux-operator-tasks. The Continuous Integration CI process installs the tkn command-line interface CLI from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to...

Malicious code in @aspect-adv-ui/consent-manager (npm)

Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTPS GET to a hardcoded webhook.site inspection endpoint...

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution RCE on glibc-based Linux when run under certain conditions. The attack vector for these claims to ...

GHSA-RGJ7-G3M4-5G8C sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution RCE on glibc-based Linux when run under certain conditions. The attack vector for these claims to ...

CVE-2026-81192

OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...

Exploit for Path Traversal in Gogs

CVE-2025-8110 - Gogs symlink bypass - arbitrary file write as...

Untrusted Search Path

Overview Affected versions of this package are vulnerable to Untrusted Search Path through the macOS host detector command execution in HostDetector.cs. An attacker can execute arbitrary code in the application's security context by supplying a malicious ioreg binary earlier in PATH and triggerin...

MAL-2026-16050 Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

Malicious code in @aspect-adv-ui/consent-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

GHSA-W6F5-V2H6-G786 Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

CVE-2026-81192

"OpenTelemetry.Resources.Host" NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the "host.id" resource attribute detector launches the "sh" and "ioreg" executables by bare name...

CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...

CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...

CVE-2026-81192 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

OpenTelemetry.Resources.Host NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the host.id resource attribute detector launches the sh and ioreg executables by bare name rather...

CVE-2026-81192

CVE-2026-81192 is an untrusted search path vulnerability in the OpenTelemetry.Resources.Host NuGet package, affecting macOS only. The host.id resource attribute detector invokes sh and ioreg by bare name, resolving them through the PATH environment variable rather than by absolute path. A less-pr...

GHSA-8MCC-HRX5-HVXC GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...

GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...