kernel security, bug fix, and enhancement update

6.12.0-211.37.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Oracle Linux 10 : git-lfs (ELSA-2026-19133)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19133 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux...

PT-2026-63356

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-16492: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

PT-2026-71453

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description A remote code execution issue exists in the check unsafe options guard. This guard can be bypassed by smuggling git options within single-character kwarg values. An attacker can provide crafted...

PT-2026-63511

Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8 Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File...

PT-2026-63273

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

Oracle Linux 10 : git-lfs (ELSA-2026-30855)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30855 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2026-71452

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description An arbitrary file overwrite issue exists in the Diffable.diff method due to insufficient validation of git options passed through kwargs. An attacker can use the --output argument via the other...

SUSE CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

SUSE CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...

Gitea: Repository Visibility Manipulation via Git Push Options

Repository Visibility Manipulation via Git Push Options | Field | Value | |-------|-------| | Affected File | routers/private/hookpostreceive.go | | Affected Function | HookPostReceive | | Affected Lines | 173–225 | | Prerequisite | Attacker must have owner-level or admin collaborator access to t...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

Insufficient Logging

Overview Affected versions of this package are vulnerable to Insufficient Logging through the processing of undocumented git push options in the HookPostReceive function. An attacker can change the visibility or template status of a repository without triggering audit logs, webhooks, or...

Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

EUVD-2026-41643

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...

GHSA-2M9V-5Q2G-58VQ Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects

Summary A user with Code write access to one repository may be able to associate an existing Git LFS object from a private source repository with their target repository, even when they do not have Code access to the source repository that currently owns the LFS object. The issue appears to be...