CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

EUVD-2026-61009

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

CVE-2026-45119

MyBB versions prior to 1.8.40 expose a CSRF flaw in the Admin CP UTF-8 Conversion module. The do=all flow in admin/modules/tools/system_health.php performs ALTER TABLE operations and fulltext index rebuilds on GET requests without request verification, allowing same-site attackers to alter table ...

CVE-2026-45119 MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates

Summary IBM App Connect Enterprise Certified Container ACEcc is built on the Red Hat Universal Base Images. ACEcc operator versions 12.0.26 and 13.4.0 contain fixes to the listed CVEs found in the base images. This bulletin provides patch information to address the reported vulnerabilities...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

CVE-2026-75913

CodeWhale versions 0.8.41–0.8.63 pass an unvalidated model-supplied rev parameter directly to git show argv without an --end-of-options sentinel, allowing a --output= value to be interpreted as a git flag. Combined with the auto-approved, read-only git_show tool and prompt injection, this enables...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

EUVD-2026-60971

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75912

CodeWhale's git_blame tool passes an unvalidated rev parameter directly to git, allowing attackers to inject options like --contents=/path/to/file to exfiltrate sensitive files (SSH keys, credentials) via tool output. CVSS 3.1 score 7.4 (High). Fixed in CodeWhale 0.8.64. No in-the-wild exploitati...

CVE-2026-75912

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

EUVD-2026-60970

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...