ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

SUSE CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

CVE-2026-19873

The HTML::FormFu Perl module (versions through 2.08 ) is vulnerable to a resource exhaustion attack (Denial of Service) due to an unbounded repeat count in Repeatable elements. When counter_name is set, the process() method reads a count from the query string and deep-clones the child subtree for...

CVE-2026-19873 HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001012 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: release elements in clone only from destroy path Clone already always...

CVE-2026-82254

gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out-of-memory process kills...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005586)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005586 advisory. Bundler is a package for managing application dependencies in Ruby. In bundler versions before 2.2.33, when working with untrusted and apparently harmless Gemfile's,...

SUSE CVE-2026-74310

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...

The vulnerability of the Repo.clone_from() and Repo.clone() functions in the git/repo/base.py module of the Python library for interacting with Git repositories in GitPython allows a malicious actor to write arbitrary files.

The vulnerability of the Repo.clonefrom and Repo.clone functions in the git/repo/base.py module of the GitPython library for interacting with Git repositories is related to an incorrect path name limitation when processing the --separate-git-dir parameter. Exploiting this vulnerability could allo...

SUSE CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-47836: Undefined Security Weakness

The base directory spring.cloud.config.server.svn.basedir used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring...

Linux Distros Unpatched Vulnerability : CVE-2026-79769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup...

Duplicate Advisory: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8mcc-hrx5-hvxc. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary g...

PYSEC-2026-3787

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

PYSEC-2026-3787

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

DEBIAN-CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

Linux Distros Unpatched Vulnerability : CVE-2026-78677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone...