CVE-2026-19617

CVE-2026-19617 affects libdm (LVM2). A remote attacker can craft a deeply nested LVM metadata configuration that triggers uncontrolled recursion in the libdm configuration parser, exhausting the stack and causing DoS for any LVM command reading the metadata. Documented impact is Denial of Service...

PT-2026-72078

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description A use-after-free issue exists in the dynamic kernel-object disposal path unref check within kernel/userspace/userspace.c. The system frees an object's storage using k freedyn-data when its...

PT-2026-72123

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.6.21 OpenVPN versions 2.7 alpha1 through 2.7.5 Description The Windows interactive service allows local authenticated users to bypass the trusted configuration directory constraint. This is achieved by using...

The vulnerability of the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform allows a perpetrator to gain full control over the application.

The vulnerability of the Enterprise Config Management component of the Oracle Enterprise Manager Base Platform is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to gain full control over the application using the HTTPS protocol...

CVE-2026-72857

Budibase before 3.40.0 has a credential exposure weakness: it does not redact credentials stored in STRING fields, enabling authenticated users with table read permissions to read MongoDB connection strings and Firebase private keys via the read API, effectively exposing live backend credentials ...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

EUVD-2026-58137

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481 Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override CWE-295...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

OESA-2026-3354 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3353 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3313 perl-Config-IniFiles security update

Config::IniFiles is a module intended to make life easier for those who rely on flat configuration files. Security Fixes: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle...

CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

UBUNTU-CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CLEANSTART-2026-TU92934 Security fixes in cass-config-builder-fips 1.0.21-r1

Package cass-config-builder-fips version 1.0.21-r1 fixes 1 vulnerabilities: ghsa-r7wm-3cxj-wff9...

EUVD-2026-57826

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

CVE-2026-73622 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

PT-2026-71463

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description The pgcrypto module allows cleartext storage when disable...