DEBIAN-CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

Linux Distros Unpatched Vulnerability : CVE-2026-78677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone...

CVE-2026-70460

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

...

CVE-2026-53795

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

Copyparty vulnerable to file/dirkey confusion

A valid filekey could potentially be converted into a dirkey, granting read-access to the containing folder. This issue only affected volumes which simultaneously enable both filekeys and dirkeys, with volflag dk or dks combined with fk or fka. Both required features are default-disabled, and mus...

SUSE CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

CVE-2026-9767

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767: Improper Neutralization of Special Elements used in an SQL Command

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-19893

A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this...

CVE-2026-19893

The CVE-2026-19893 entry affects D-Link DIR-842 (firmware 2.01.B04) via the vsftpd component, specifically manipulating the /etc/vsftpd.conf file to cause incorrect default permissions. The vulnerability is exploitable remotely with high attack complexity and low exploitability assessment, though...

CVE-2026-19893 D-Link DIR-842 vsftpd vsftpd.conf default permission

A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this...

EUVD-2026-59743

A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this...

PT-2026-72888

Name of the Vulnerable Software and Affected Versions D-Link DIR-842 version 2.01.B04 Description A flaw exists in the vsftpd component within the /etc/vsftpd.conf file. This issue allows for remote manipulation that results in incorrect default permissions. The attack is characterized by high...

CVE-2026-19893: Incorrect Default Permissions

A vulnerability was identified in D-Link DIR-842 2.01.B04. This impacts an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Such manipulation leads to incorrect default permissions. It is possible to launch the attack remotely. A high complexity level is associated with this...