14943 matches found
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...
CVE-2026-47090
Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd and branchUrl values without stripping control characters or encoding embedded values, allowing attackers to inject arbitrary ANSI codes into terminal sessions. Attackers can...
SUSE CVE-2026-44309
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git...
Insufficient Verification Of Data Authenticity
go-git is vulnerable to Insufficient Verification of Data Authenticity. The vulnerability is due to improper handling of malformed or ambiguous Git object headers and reconstructing commit data for signing and verification instead of using the original raw object bytes, which allows an attacker t...
CVE-2026-44310
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify in pkg/git/verifier.go unconditionally dereferences certs0 after sd.GetCertificates without checking the slice length. A CMS/PKCS7 signed message with...
CVE-2026-44309
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git...
[SECURITY] Fedora 44 Update: rust-sequoia-git-0.6.0-2.fc44
A tool for managing and enforcing a commit signing policy...
CVE-2026-37430
An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploading a crafted file...
WS-2020-0436
In commit-msg in versions 0.1.0 to 0.2.3 is vulnerable to RCE, via insecure command formatting...
@hashgraph/stablecoin-npm-cli (>=2.0.0, <=4.4.0), @hashgraph/stablecoin-npm-contracts (>=2.0.0, <=4.4.0) +2 more potentially affected by unknown CVE via commit-msg (0.2.3)
commit-msg NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on commit-msg and may be impacted: - @hashgraph/stablecoin-npm-cli =2.0.0, =2.0.0, =2.0.0, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: MEND:WS-2020-0436...
CVE-2024-55045
Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the taskmavobcentry function at /comm/taskcomm.c...
CVE-2026-41576
Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible no authentication required. User-supplied message text is passed through PHP's nl2br function, which converts newlines to tags but does not escape HTML. The resulting string is then passed to a Blade...
EUVD-2024-55580
Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the taskmavobcentry function at /comm/taskcomm.c...
CVE-2026-37430
An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploading a crafted file...
BIT-MONGODB-2025-14345 Cross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB Server
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction...
PT-2026-40629
Name of the Vulnerable Software and Affected Versions Firmament-Autopilot FMT-Firmware commit de5aec Description A buffer overflow exists in the task mavobc entry function located at /comm/task comm.c. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than ...
CVE-2024-55045
The Firmament-Autopilot FMT-Firmware (commit de5aec ) contains a buffer overflow vulnerability within the task_mavobc_entry function located at /comm/task_comm.c. This flaw occurs when the program writes more data to a memory block than it is permitted to hold, which may result in crashes or arbi...
