SUSE-SU-2026:3196-1 Security update for joe

This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379...

CVE-2026-62145

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...

CVE-2026-62144

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

EUVD-2026-47702

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges...

CVE-2026-62144

CVE-2026-62144 describes an authentication bypass in Check Point’s Security Management and Multi-Domain Security Management Server. An unauthenticated attacker can run administrative commands on the Management Server, with possible command execution on connected Security Gateways. Exploitation re...

CVE-2026-44192

CVE-2026-44192 affects the Ansible Lightspeed Model Context Protocol (MCP) server. The vulnerability is a path traversal flaw that can be triggered to manipulate an AI agent via indirect prompt injection, allowing writing of files to unauthorized locations on the user’s system, which may expose s...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent - WLS Security is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attacke...

Oracle Linux 10 : vim (ELSA-2026-28210)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-28210 advisory. - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete -...

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Summary GitPython spawns the real git binary with an argument vector built from caller-supplied values. To prevent argument injection, GitPython maintains denylists of "unsafe" Git options --upload-pack, --receive-pack, --exec, -c, --config, … that can be abused to run arbitrary commands, and...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Repo.archive, Repo.itercommits, Repo.blame, and Git.lsremote call paths in git/repo/base.py, git/objects/commit.py, and git/cmd.py...

AZL-93102 CVE-2026-16493 affecting package ansible 2.17.11-1

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

The CVE-2026-16493 entry describes a command-injection vulnerability in ansible-core where _extract_collection_from_git() builds git clone commands without a proper end-of-options separator, allowing an attacker to craft a collection source URI that injects payloads during ansible-galaxy collecti...

EUVD-2026-46336

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-47392

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...

MAL-2026-10988 Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Malicious code in react-tabulix-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e1730bc033ffe3e5cbe24819446e0c6d41af7bec46ec931a04eca2909ffc7cc package.json declares a preinstall hook node./dist/index.d.js that runs automatically on npm install. The script at dist/index.d.js decodes a...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14 package.json declares scripts.preinstall as node./dist/index.d.js, which runs automatically on npm install. dist/index.d.js contains a base64-encoded...