PT-2026-61721

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions prior to 2.19.0 Apache MINA SSHD versions prior to 3.0.0-M5 Description Improper input validation in the sshd-git component of Apache MINA SSHD, specifically within the GitPgmCommandFactory, allows an authenticated SS...

[SECURITY] Fedora 44 Update: opam-2.5.2-1.fc44

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

GO-2026-5937 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) in github.com/oasdiff/oasdiff

oasdiff does not enforce --allow-external-refs=false on the git-revision load path SSRF / local file read in github.com/oasdiff/oasdiff...

CVE-2026-63093

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves a...

CVE-2026-63093 Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves a...

CVE-2026-63093 Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves a...

CVE-2026-63093

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves a...

CVE-2026-63093

CVE-2026-63093 affects Cursor for Windows 3.2.16. The issue is a binary planting vulnerability: if a malicious file named git.exe is placed in the repository root, Cursor can resolve and execute it during IDE startup and on a recurring cadence, executing with the current user’s privileges. This e...

PT-2026-60775

Name of the Vulnerable Software and Affected Versions Cursor for Windows version 3.2.16 Description A binary planting issue allows remote attackers to achieve arbitrary code execution. This occurs when a developer clones and opens a crafted repository containing a malicious git.exe file in the ro...

OPENSUSE-SU-2026:11290-1 gomuks-26.03+git.1780250926.564a8707-1.1 on GA media

These are all security issues fixed in the gomuks-26.03+git.1780250926.564a8707-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-53535

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535

Activepieces prior to 0.82.0 is affected by an arbitrary file write in the git-sync workflow. The issue occurs because git-sync clones a configured repository into a temporary server directory with Git’s symbolic-link handling enabled, allowing symlinks to redirect writes. Additionally, on-disk i...

EUVD-2026-45028

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b627f9a4ff0aaacfcd612224f76fe679e9d0a04578519d75516136e7496aad43 The package installs itself as a user-level service systemd on Linux via service/linux.js, with launchd/PM2 siblings and, at agent startup, opens a...

CVE-2026-38974

A flaw was found in Dulwich. The contrib/paramikovendor.py component is missing Secure Shell SSH host key verification. This vulnerability allows a remote attacker to impersonate a legitimate Git server. By doing so, the attacker could potentially intercept sensitive information or execute...

PT-2026-60499

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...