PT-2026-72123

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.6.21 OpenVPN versions 2.7 alpha1 through 2.7.5 Description The Windows interactive service allows local authenticated users to bypass the trusted configuration directory constraint. This is achieved by using...

The vulnerability of the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform allows a perpetrator to gain full control over the application.

The vulnerability of the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to gain full control over the application using the HTTPS protocol...

CVE-2026-72857

Budibase before 3.40.0 has a credential exposure weakness: it does not redact credentials stored in STRING fields, enabling authenticated users with table read permissions to read MongoDB connection strings and Firebase private keys via the read API, effectively exposing live backend credentials ...

MAL-2026-13985 Malicious code in node-config-svg-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtim...

Malicious code in node-config-svg-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtim...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

EUVD-2026-58137

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481

The Gitea Git repository management system contains a flaw where the internal API HTTP client hardcodes InsecureSkipVerify:true in the init-function of the internalAPITransport function (located in modules/private/internal.go). This lack of TLS certificate verification allows a remote attacker on...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

Malicious Package

Overview node-config-svg-contract is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

OESA-2026-3354 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3353 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3313 perl-Config-IniFiles security update

Config::IniFiles is a module intended to make life easier for those who rely on flat configuration files. Security Fixes: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle...

CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

UBUNTU-CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CLEANSTART-2026-TU92934 Security fixes in cass-config-builder-fips 1.0.21-r1

Package cass-config-builder-fips version 1.0.21-r1 fixes 1 vulnerabilities: ghsa-r7wm-3cxj-wff9...

CVE-2026-73622 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

EUVD-2026-57826

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...