dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...

CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

UBUNTU-CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

CVE-2026-67323 GitPython before 3.1.51 Command Injection via unguarded Git options

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

EUVD-2026-51805

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

CVE-2026-67323

GitPython < 3.1.51 is affected. The vulnerability stems from failing to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), enabling command injection via options like --exec and --upload-pack. Additionally, Repo.iter_commits() and Repo.blame(...

SUSE-SU-2026:3099-1 Security update for dash

This update for dash fixes the following issues - CVE-2026-31323: arithmetic expansion evaluating INTMAXMIN / -1 can lead to a signed integer overflow and a denial of service bsc1269494...

CVE-2026-45068

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginnin...

CVE-2026-45068 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginnin...

CVE-2026-45068 Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginnin...

CVE-2026-45068

CVE-2026-45068 affects Symfony’s SendmailTransport in -t mode. Prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, recipient addresses were appended to the sendmail command line without a -- end-of-options separator, so an address starting with - could be treated as a sendmail option rather tha...

PYSEC-2026-3433 yt-dlp: Arbitrary code execution via manifest downloads with aria2c

Summary If aria2c is used as an external downloader for a fragmented manifest format such as an HLS/DASH stream, yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code...

OPENSUSE-SU-2026:21301-1 Security update for dash

This update for dash fixes the following issues - CVE-2026-31323: Fix CVE-2026-31323 INTMAXMIN / -1 overflow bsc1269494. - executes code even when noexec "-n" is specified bsc1178978...

PYSEC-2026-320 dash-uploader has a directory traversal vulnerability

Impact An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dashuploader/httprequesthandler.py reads three form parameters uploadid, resumableFilename, resumableIdentifier from request.form.get and passes the...

OPENSUSE-SU-2026:21163-1 Security update for yt-dlp

This update for yt-dlp fixes the following issues: Changes in yt-dlp: - Update to version 2026.06.09 Fixed CVE-2026-50019: File Downloader cookie leak with curl Fixed CVE-2026-50023: Dangerous file type creation via insufficient filename sanitization Fixed CVE-2026-50574: Arbitrary code execution...

OPENSUSE-SU-2026:11143-1 dash-0.5.13.4-1.1 on GA media

These are all security issues fixed in the dash-0.5.13.4-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-53937

Name of the Vulnerable Software and Affected Versions dash versions prior to 0.5.13.4-1.1 Description An integer overflow occurs when dividing INTMAX MIN by -1. Additionally, the software may execute code even when the -n noexec option is specified. Recommendations Update to version 0.5.13.4-1.1...