AZL-106812 CVE-2026-93326 affecting package moby-engine 25.0.3-20

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259

ESPHome (up to 2026.7.0-dev) is affected by an operator-precedence bug in the cv.url() validator within esphome/config_validation.py. The condition if parsed.scheme and parsed.netloc or parsed.scheme == "file" incorrectly permits file:// URIs to bypass validation, affecting the url: field of the ...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection through gitSourceHandler.checkoutAsBundle in source/git/bundle.go and getDefaultBranch in source/git/source.go. An attacker can trigger crafted host-side git command arguments by supplying a malicious Git...

CVE-2026-15793

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

PT-2026-61986

Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description Custom frontends or clients utilizing the raw low-level API may set the git.checkoutbundle variable to true during the checkout of Git sources. A malicious Git source can exploit this...

CVE-2025-64424

CVE-2025-64424 affects Coolify up to v4.0.0-beta.434, enabling a low-privileged user to run commands as root via a command-injection in the git source input fields of a resource. Several connected sources corroborate the vulnerability class and affected components; remediation notes indicate fixe...

CVE-2025-64424 Colify has command injection vulnerability in project git source

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user member to execute syst...

CVE-2025-64424 Colify has command injection vulnerability in project git source

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user member to execute syst...

CVE-2025-64424 Colify has command injection vulnerability in project git source

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user member to execute syst...

PT-2026-1335

Name of the Vulnerable Software and Affected Versions Coolify versions up to and including v4.0.0-beta.434 Description Coolify is a self-hostable tool for managing servers, applications, and databases. A command injection exists in the git source input fields of a resource, potentially allowing a...

CVE-2025-64424: Improper Neutralization of Special Elements used in a Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user member to execute syst...

EUVD-2025-21002

Malicious code in bioql PyPI...

CVE-2025-27613

creationtimestamp| type| source ---|---|--- 2025-07-08 15:02:11+00:00| seen| https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/ 2025-07-08 15:11:31+00:00| seen| https://seclists.org/oss-sec/2025/q3/13 2025-07-08 15:56:31+00:00| seen|...

GHSA-FM76-W8JW-XF8M @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source

Summary When creating a new plugin using the git source, the user-controlled value req.body.name is used to build the plugin directory where the location will be cloned. The API used to execute the git clone command with the user-controlled data is childprocess.execSync. Since the user-controlled...