PT-2026-67513

The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to child process.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...

The vulnerability of the `gix_worktree_state::checkout()` function in the Rust library for working with Git repositories like gitoxide, allows a malicious actor to execute arbitrary code.

The vulnerability of the gixworktreestate::checkout function in the Rust library for working with Git repositories like gitoxide is related to an incorrect definition of symbolic references before accessing files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary co...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypa...

Malicious code in trongriden (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-11429 Malicious code in trongriden (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Exploit for CVE-2025-68937

CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated...

Exploit for Improper Access Control in Ollyo Helix3

CVE-2026-49049 Mass Scanner Mass vulnerability scanner for CV...

auditoria-ciberseguridad-2026

🔐 Auditoría de Ciberseguridad: Hydra, Wazuh & Suricata ⚠️...

onyx-agent

Onyx Agent v68 Multi-LLM agent framework for security testing...

Linux Distros Unpatched Vulnerability : CVE-2026-67322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl,...

Linux Distros Unpatched Vulnerability : CVE-2026-67325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers ca...

Security update for keybase-client (low)

openSUSE Security Update: Security update for keybase-client Announcement ID: openSUSE-SU-2026:0272-1 Rating: low References: Cross-References: CVE-2026-39824 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for...

Linux Distros Unpatched Vulnerability : CVE-2026-67324

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an...

Linux Distros Unpatched Vulnerability : CVE-2026-67323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection vi...

Linux Distros Unpatched Vulnerability : CVE-2026-67326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers in...

iwd-security-poc

iwd 3.12 — four Wi-Fi parser/handler bugs Proof-of-concept co...

SUSE CVE-2026-39824

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

SUSE CVE-2026-45570

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containin...

[SECURITY] Fedora 43 Update: libgit2-1.9.6-1.fc43

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language with bindings...

[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...