SUSE-SU-2026:20585-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - Enable SELinux in default daemon.json config --selinux-enabled. This has no practical impact on non-SELinux systems bsc1252290. - Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up...

OPENSUSE-SU-2026:20262-1 Security update for docker-stable

This update for docker-stable fixes the following issues: - Enable SELinux in default daemon.json config --selinux-enabled. This has no practical impact on non-SELinux systems bsc1252290. - Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up...

CVE-2026-27113: Improper Neutralization of Special Elements used in an OS Command

Liquid Prompt is an adaptive prompt for Bash and Zsh. Starting in commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and prior to commit a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c on the master branch, arbitrary command injection can lead to code execution when a user enters a directory in a Git...

Cursor < 2.5 RCE (GHSA-8pcm-8jpx-hv8r)

The version of Cursor installed on the remote host is prior to 2.5. It is, therefore, affected by a remote code execution vulnerability: - A malicious agent ie prompt injection could write to improperly protected .git settings, including git hooks, which may cause out-of-sandbox remote code...

CVE-2026-26323

OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script scripts/update-clawtributors.ts. The issue affects contributors/maintainers or CI who run bun scripts/update-clawtributors.ts in a source checkout that contains a malicio...

apilogicserver (>=9.1.32, <=17.0.0), archivy (>=1.7.5, <=1.7.7) +14 more potentially affected by CVE-2026-27199 via werkzeug (2.3.3)

werkzeug PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - apilogicserver =9.1.32, =1.7.5, =0.1.0, =0.1.0, =0.2.0, =0.1.6, =0.1.0, =0.9.0, =1.0.5, =0.8.0, =2.9.0, =0.7.1.dev0, =1.0.5, =0.1.0, =0.4.0 and...

GO-2026-4473 Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git

Improper verification of data integrity values for .idx and .pack files in github.com/go-git/go-git...

CVE-2025-15586

OpenGamePanel (OGP-Website) is affected by a type juggling flaw in PHP comparisons present in commits prior to 52f865a4fba763594453068acf8fa9e3fc38d663. If exploited, this can enable authentication bypass without knowledge of the victim’s password. Public references (Red Hat CVE page, NVD entry, ...

CVE-2026-25232 Gogs has a Protected Branch Deletion Bypass in Web Interface

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches including the default branch by sending a direct POST request, completely bypassing th...

CVE-2026-25120: Authorization Bypass Through User-Controlled Key

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment...

CVE-2026-26323: Improper Neutralization of Special Elements used in an OS Command

OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script scripts/update-clawtributors.ts. The issue affects contributors/maintainers or CI who run bun scripts/update-clawtributors.ts in a source checkout that contains a malicio...

CVE-2025-15586: Improper Authentication

OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password...

Gogs 安全漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.4 and earlier have security vulnerabilities. These...

Gogs 安全漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.4 and earlier have security vulnerabilities; these...

io.relution.jenkins:scm-sqs (>=1.2, <=1.4), org.jenkins-ci.main:jenkins-test-harness (1.626) +6 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.626)

org.jenkins-ci.main:jenkins-core MAVEN version 1.626 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - io.relution.jenkins:scm-sqs =1.2, =0.1, =0.2, =0.1, =1.21, =1.24 Source cves: CVE-2026-27100...

org.jenkins-ci.main:jenkins-test-harness (1.580.2), org.jenkins-ci.main:jenkins-war (1.580.2) +3 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.580.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.580.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-test-harness 1.580.2 - org.jenkins-ci.main:jenkins-war 1.580.2 -...

com.base2services.jenkins:github-sqs-plugin (>=1.0, <=1.5), org.jenkins-ci.main:jenkins-test-harness (1.451) +9 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.451)

org.jenkins-ci.main:jenkins-core MAVEN version 1.451 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.base2services.jenkins:github-sqs-plugin =1.0, =2.4, =1.1, =1.3 Source cves: CVE-2026-27100...

com.parallels:parallels-desktop (>=0.4, <=0.6), org.fedoraproject.jenkins.plugins:copr (0.6.1) +7 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.651.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.parallels:parallels-desktop =0.4, =1.6, =0.7.0, =0.8.1 Source cves: CVE-2026-27100 Source...

com.coravy.hudson.plugins.github:github (>=1.9, <=1.9.1), org.jenkins-ci.main:jenkins-test-harness (1.448) +10 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.448)

org.jenkins-ci.main:jenkins-core MAVEN version 1.448 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =1.9, =1.3.0, =1.0.5, =2.6, =2.17 -...

GO-2026-4448 Gogs's update .git/config file allows remote command execution in gogs.io/gogs

Gogs's update .git/config file allows remote command execution in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...