CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44798 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44798 Source advisory: OSV:GHSA-P3HX-PWF3-J8WR...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44797 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44797 Source advisory: OSV:GHSA-C35Q-VXRP-PH26...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44796 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44796 Source advisory: OSV:GHSA-QRPW-GJVH-X5GM...

nautobot-golden-config (>=0.9.2.dev0, <=0.9.4), thola-nautobot (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-44794 via nautobot (1.0.3)

nautobot PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on nautobot and may be impacted: - nautobot-golden-config =0.9.2.dev0, =0.1.0, =0.2.0 Source cves: CVE-2026-44794 Source advisory: OSV:GHSA-WPXJ-44W3-2J6X...

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Summary The Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray from within a page body, dumping the entire merged site configuration — including all plugin secrets SMTP passwords, AWS keys, OAuth client secrets, API tokens — into the rendered HTML. No...

GHSA-J274-39QW-32C9 Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()

Summary The Twig sandbox allow-list permits any user with the admin.pages role to call config.toArray from within a page body, dumping the entire merged site configuration — including all plugin secrets SMTP passwords, AWS keys, OAuth client secrets, API tokens — into the rendered HTML. No...

EUVD-2026-29135

Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray...

GHSA-3644-Q5CJ-C5C7 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Description The LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Description The LangSmith SDK's prompt pull methods pullprompt / pullpromptcommit in Python, pullPrompt / pullPromptCommit in JS/TS fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime...

CVE-2026-42406

CVE-2026-42406 affects BIG-IP and BIG-IQ. A highly privileged, authenticated user with at least the Certificate Manager role can modify configuration objects that enable running arbitrary commands, potentially executing system commands and creating/deleting files. On BIG-IP, exploitation may bypa...

CVE-2026-41225

CVE-2026-41225 affects F5 BIG-IP iControl REST. A highly privileged, authenticated user (Manager) can create configuration objects that execute arbitrary commands. Impact is control-plane–level: privilege escalation and possible cross-boundary access in appliances; data plane remains unaffected p...

CVE-2026-39459 iControl REST and tmsh vulnerability

A vulnerability exists in iControl REST and the TMOS Shell tmsh where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support EoTS are not...

K000160916: iControl REST vulnerability CVE-2026-41225

Security Advisory Description A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. CVE-2026-41225 Impact This vulnerability may allow a highly privileged...

CVE-2026-25107

The CVE-2026-25107 entry concerns ELECOM wireless LAN access point devices that use a hard-coded cryptographic key when creating configuration backups. A knowledgeable attacker could tamper a product’s backup configuration file, and a victim administrator could be tricked into loading a crafted c...

CVE-2026-25107

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file...

Malicious code in github.com/BufferZoneCorp/config-loader (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

MAL-2026-3620 Malicious code in github.com/BufferZoneCorp/config-loader (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

PT-2026-40826

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.7 Description OPNsense is a FreeBSD based firewall and routing platform. The XMLRPC method 'opnsense.restore config section' fails to sanitize user supplied input, which can lead to Remote Code Execution RCE, a...

Hoppscotch Access Control Vulnerability

Hoppscotch is an open-source API development ecosystem created by Hoppscotch. Versions of Hoppscotch from 2026.2.0 to 2026.4.0 contained a access control vulnerability. This vulnerability stemmed from the GET /v1/onboarding/config endpoint, which still exposed all infrastructure secrets in plain...