CVE-2026-12888 HTML injection in the Canarytoken Google Chat notification

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90...

CVE-2026-12888

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90...

EUVD-2026-38240

An HTML injection vulnerability exists in the Google Chat webhook notification sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to the SSH client not verifying remote host keys for git+ssh:// connections. An attacker can intercept and compromise mirrored repositories by performing man-in-the-middle attacks...

CVE-2026-11745

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...

CVE-2026-11745

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...

CVE-2026-11745

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-1879)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1879 advisory. go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during...

Medium: amazon-ssm-agent

Issue Overview: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

Medium: amazon-ssm-agent

Issue Overview: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

OPENSUSE-SU-2026:11087-1 git-annex-10.20260601-2.1 on GA media

These are all security issues fixed in the git-annex-10.20260601-2.1 package on the GA media of openSUSE Tumbleweed...

Amazon Linux 2023 : git-lfs (ALAS2023-2026-1889)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1889 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Tenable has extracted the preceding description block directly from the tested product...

podman -- files outside build context may be included via malicious Git repo or tar archive

The Podman developers report: Building a Dockerfile using an ADD or COPY instruction accessing a malicious Git repository or tar archive could cause files outside the build context directory to be included in the build context or copied into the build...

Important: git-lfs

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Affected Packages: git-lfs Issue Correction: Run dnf update git-lfs --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1889 --releasever 2023.12.20260622 ...

SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:2468-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2468-1 advisory. This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang.org/x/crypto/ssh...

PT-2026-51270

Name of the Vulnerable Software and Affected Versions centraldogma-server-mirror-git versions prior to 0.84.0 Description The Git mirror SSH client fails to verify remote host keys for git+ssh:// connections. This allows an on-path attacker to conduct man-in-the-middle attacks, which can lead to...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3378 (ALAS-2026-3378)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.4624.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3378 advisory. go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2,...

Important: ansible-core

Issue Overview: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags throu...

PT-2026-51386

Name of the Vulnerable Software and Affected Versions mise versions prior to 2026.3.10 Description mise processes .tool-versions files using the Tera template engine, which includes a registered exec function that allows for arbitrary command execution. In the default non-paranoid mode,...

CVE-2026-11745: Undefined Security Weakness

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories...