CVE-2026-44244 GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.setvalue passes values to Python's configparser without validating for newlines. GitPython's own write converts embedded newlines into indented continuation lines e.g. \n becomes \n\t, b...

PYSEC-2026-2317

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

PYSEC-2026-2317

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-41684

Summary of CVE-2026-41684 (Incus): An authenticated user who can import instance backups may crash the Incus daemon during restore when a crafted backup archive includes a valid inline backup/index.yaml but a malformed legacy backup.yaml that omits the container section. The vulnerability arises ...

CVE-2026-41684 Incus: Nil Dereferences on Restore via Malformed YAML

Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid...

CVE-2026-41684

Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid...

CVE-2026-41684 Incus: Nil Dereferences on Restore via Malformed YAML

Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid...

com.tairanchina.csp.dew:config (>=1.5.0-beta, <=1.5.1-rc), org.springframework.cloud:spring-cloud-config-monitor (1.4.4.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.tairanchina.csp.dew:config =1.5.0-beta,...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.0.0.release, <=2.0.1.release), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.0.2.release, <=2.0.4.release) +1 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.mosip.kernel:kernel-config-server (>=1.1.2-rc2, <=1.1.2), org.springframework.cloud:spring-cloud-config-monitor (2.0.4.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.mosip.kernel:kernel-config-server =1.1.2-rc2...

ai.hyacinth.framework:core-service-config-server (>=0.5.8, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.1.1.release) +10 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

io.mosip.kernel:kernel-config-server (>=1.2.1-rc1, <=1.3.1), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=7.0.0, <=7.1.6.2) +5 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.1.0, <=4.1.7)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.1.0, =1.2.1-rc1, =7.0.0, =7.0.0, =4.1.0, =3.1.0, =3.1.6 Source cves: CVE-2026-40982 Source advisory: GHSA-6G23-24MC-HX6X...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.2.7.release, <=2.2.8.release), com.buession.springcloud:buession-springcloud-config-server (>=1.3.0, <=2.3.3) +19 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.ecfront.dew:config (1.2.2-rc), com.ixortalk:ixortalk-config-server (2.0.0) +3 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ecfront.dew:config 1.2.2-rc -...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1) +27 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1,...

ai.hyacinth.framework:core-service-config-server (0.5.24), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.2.0.release) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

org.springframework.cloud:spring-cloud-config-monitor (1.4.5.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.microservices:cloud-altemistafwk-core-microservices-config-conf (3.1.0.release) +8 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-config-monitor (1.4.1.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.home1:oss-configserver =1.0.6.oss, =1.0.7.os...