EUVD-2026-91045

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

PT-2026-104001

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pull request and executes code supplied by the pull request before any maintainer review. Three...

EUVD-2026-74845

GitPython: Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing...

EUVD-2026-74843

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

BIT-GITLAB-2024-11222 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

OESA-2026-4027 python-GitPython security update

GitPythonis a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files...

OESA-2026-4025 python-GitPython security update

GitPythonis a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files...

OESA-2026-4026 python-GitPython security update

GitPythonis a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files...

PT-2026-98973

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...

Verifiable Randomness for Blockchain-Based Lottery Systems

As lotteries and other high-stakes decentralized applications increasingly depend on unpredictable randomness for their operations, the lack of a secure and transparent on-chain random number generator that is verifiable by all participants remains a critical open problem. Various approaches to...

PT-2026-105621

Denial of Service via catastrophic backtracking ReDoS in Actor.name email regex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

The vulnerability of the `GenericDNSPacketWriter::commit()` function in the pdns/dnswriter.c file of the load balancer and proxy for DNS traffic, DNSdist, allows a attacker to cause a service failure.

The vulnerability of the GenericDNSPacketWriter::commit function in the pdns/dnswriter.c file of the load balancer and proxy for DNS traffic is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failur...

EUVD-2026-86272

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JSReadFunctionTag...

CVE-2026-88369

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump...

CVE-2026-88369

The zserge jsmn library, specifically commit 25647e6 , is vulnerable to a Buffer Overflow in the example/jsondump.c file within the dump() function. While the vulnerability is documented across multiple distributions (including Debian and Ubuntu), some sources indicate that the vendor may not hav...

CVE-2026-88378

The QuickJS engine (commit 04be24600) is affected by a heap out-of-bounds write condition located in the JS_ReadFunctionTag() function. This vulnerability is present in various Linux distributions, though some sources indicate that a vendor-supplied patch may not be available for certain impacted...