PT-2026-103965

Name of the Vulnerable Software and Affected Versions AWS security-agent-mcp-server versions prior to 0.2.0 Description An argument injection issue exists in the diff scan operation. A threat actor can provide a crafted reference value to the diff scan operation to create, overwrite, or truncate...

AlmaLinux 9.2 [TuxCare] Security Update: patch Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784720743)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784720743 advisory. - GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handli...

GHSA-WHH4-5Q6C-9V3X GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

Summary GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile. However, the high-level diff API still permits --no-index with the default allowunsafeoptions=False. --no-index changes the semantics of the paths arguments: instead...

Rocky Linux 9.6 [TuxCare] Security Update: patch Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784218870)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784218870 advisory. - GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper...

AlmaLinux 9.6 [TuxCare] Security Update: patch Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784218870)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784218870 advisory. - GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handli...

CVE-2026-102437

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-102437

The esengine DeepSeek-Reasonix (Reasonix Studio) desktop application contains an OS Command Injection vulnerability in the internal/gitcmd component. The root cause is the improper neutralization of special elements during the invocation of git diff filter.clean/smudge . A local attacker who can ...

CVE-2026-84739

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739

GitLab CE/EE versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are vulnerable to a Cross-site Scripting (XSS) issue. The root cause is the improper sanitization of path components within the merge request diff viewer . This flaw could allow an authenticated user to exe...

EUVD-2026-88687

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

PT-2026-102520

Name of the Vulnerable Software and Affected Versions DeepSeek-Reasonix Studio versions prior to 2.21.0 DeepSeek Reasonix npm versions prior to 1.39.3 Description An OS command injection flaw exists in the internal/gitcmd component of DeepSeek-Reasonix Reasonix Studio. A local attacker who contro...

CVE-2026-102437: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

FreeBSD: VID-3f11e437-b7cd-11f1-a883-2cf05da270f3 (CVE-2026-84739): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...