GHSA-GHHP-3QVG-889P vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

GHSA-CQJC-RMPQ-XPRQ vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-W7CW-XP7H-6J5J vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73411

Vulnerability summary (CVE-2026-73411) : The Shescape JavaScript library is affected by a flaw in getEscapeFunction (src/internal/unix/dash.js) prior to versions 2.1.14 and 3.0.1. When using escape or escapeAll APIs on Unix with shell set to dash (or shell=true when Dash is default), the code fai...

CVE-2026-73411

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, a...

CVE-2026-17266

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

EUVD-2026-57364

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

EUVD-2026-57251

An authenticated user may write files outside the intended Artifactory work directory under specific conditions...

CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286 Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

EUVD-2026-57216

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...

CVE-2026-67286

CVE-2026-67286 affects the Joomla extension for SP Page Builder by joomshaper.com prior to version 6.8.0. The issue allows an unauthenticated attacker to create arbitrary directories and write files using a predefined name, enabling potential local impact on the affected site. The provided metric...

Important: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...