Malicious Package

Overview @blurrydespair/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

...

Malicious Package

Overview kelly-sizing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview boto4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

SUSE CVE-2026-76217

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

CVE-2026-70461

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

PT-2026-78902

Joomla Extension - phoca.cz - Reflected XSS via price from & price to filter parameters in Phoca Cart 5.0.0-6.1.7...

Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hh9p-6wh2-4mfc. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in...

GHSA-W672-239G-C3GR Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hh9p-6wh2-4mfc. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in...

Malicious Package

Overview digital-interview-digital-interview-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

EUVD-2026-62458

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

CVE-2026-76217

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...

BIT-POSTGRESQL-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103699)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103699 advisory. It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This...

CVE-2026-73136: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

CVE-2026-73829: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...