12271 matches found
GO-2025-4013 vulnerabilities
Vulnerabilities for packages: rekor, shfmt, apisix-ingress-controller, falco-exporter, terraform-provider-time, guac, kubernetes-secret-generator, multus-cni-fips, conftest, envconsul, onepassword-operator, secrets-store-csi-driver-provider-aws-fips, dockerize, aws-sigv4-proxy, portieris-fips,...
GO-2025-4009 vulnerabilities
Vulnerabilities for packages: rekor, shfmt, apisix-ingress-controller, falco-exporter, terraform-provider-time, guac, kubernetes-secret-generator, multus-cni-fips, conftest, envconsul, onepassword-operator, secrets-store-csi-driver-provider-aws-fips, dockerize, aws-sigv4-proxy, portieris-fips,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: aactl, podinfo, flannel, kubescape-operator, spire-server, telegraf, aws-flb-cloudwatch, cilium-cli, dask-gateway, influx, kubeflow, cri-tools, falco-no-driver, kubo, litefs, newrelic-infra-operator, k8sgateway, temporal-ui-server, kapp, vault-benchmark,...
CVE-2026-19884: Inclusion of Functionality from Untrusted Control Sphere
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...
CVE-2026-47191: Improper Verification of Cryptographic Signature
kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...
Linux Distros Unpatched Vulnerability : CVE-2026-73623
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command executio...
PT-2026-72121
Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...
PT-2026-72042
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...
Linux Distros Unpatched Vulnerability : CVE-2026-73625
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-73840
OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...
CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
CVE-2026-57894
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437 Repository Visibility Manipulation via Git Push Options
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
