293577 matches found
GitPython unsafe clone option gate bypass through joined short options
GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...
Command Injection
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the canonicalizeoptionname function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as...
GHSA-V396-V7Q4-X2QJ GitPython unsafe clone option gate bypass through joined short options
GitPython version 3.1.50 blocks unsafe git clone options such as --upload-pack, -u, --config, and -c unless callers explicitly pass allowunsafeoptions=True. However, the default unsafe-option gate does not recognize joined short-option forms such as -u/path/to/helper. Git itself accepts -u as the...
CVE-2026-64878 Command Injection
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...
CVE-2026-64878 Command Injection
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...
CVE-2026-64878
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...
CVE-2026-64878
CVE-2026-64878 is a command-injection vulnerability described as unvalidated input in asset filter parameters that allows shell metacharacters to escape command argument handling, enabling remote code execution on a low-privileged OS user via the Analysis REST endpoint. The connected Tenable advi...
Exploit for CVE-2026-53595
CVE-2026-53595 + CVE-2026-53593 — FreeScout Anonymous ATO →...
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...
GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate
Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...
Security Bulletin: Multiple Vulnerabilities affect IBM License Metric Tool v9
Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-38969 DESCRIPTION: Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that...
dirtyfrag
Dirty Frag: Universal Linux LPE Abstract !tuxasse...
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...
GHSA-82F7-87HM-852X Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...
CVE-2026-63453
Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...
CVE-2026-63454
An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...
CVE-2026-63856
A flaw was found in the Linux kernel's AMDGPU Video Core Next VCN 2.0 component. This vulnerability arises because the VCN encoder and decoder rings do not properly support 64-bit user fence writes. An attacker could exploit this by submitting command sequences with 64-bit user fences, leading to...
GHSA-H35F-9H28-MQ5C setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...
setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
Summary When building a source distribution python -m build --sdist / setup.py sdist, setuptools' FileList applies MANIFEST.in directives exclude, global-exclude, recursive-exclude, prune by matching a compiled glob against on-disk file names byte-for-byte, with no Unicode normalization. On...
