GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

GHSA-2F96-G7MH-G2HX GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Command injection via long-option prefix abbreviation bypassing checkunsafeoptions incomplete fix of CVE-2026-42215 / GHSA-rpm5-65cw-6hj4 Component: gitpython-developers/GitPython PyPI: GitPython Affected: all versions carrying the 3.1.47 blocklist fix, through current main verified at commit...

GitPython unsafe clone option gate bypass through joined short options

GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...

GHSA-V396-V7Q4-X2QJ GitPython unsafe clone option gate bypass through joined short options

GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...

CVE-2026-64878

CVE-2026-64878 is a command-injection vulnerability described as unvalidated input in asset filter parameters that allows shell metacharacters to escape command argument handling, enabling remote code execution on a low-privileged OS user via the Analysis REST endpoint. The connected Tenable advi...

CVE-2026-64878

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

CVE-2026-64878 Command Injection

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

Exploit for CVE-2026-53595

CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO →...

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-38969 DESCRIPTION: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract !tuxasse...

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...

GHSA-82F7-87HM-852X Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...

CVE-2026-63454

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

CVE-2026-63453

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-63856

A flaw was found in the Linux kernel's AMDGPU Video Core Next VCN 2.0 component. This vulnerability arises because the VCN encoder and decoder rings do not properly support 64-bit user fence writes. An attacker could exploit this by submitting command sequences with 64-bit user fences, leading to...

GHSA-H35F-9H28-MQ5C setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...

GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...