GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

NewStart CGSL MAIN 7.02 : samba Multiple Vulnerabilities (NS-SA-2026-0095)

The remote NewStart CGSL host, running version MAIN 7.02, has samba packages installed that are affected by multiple vulnerabilities: - A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the print command...

NewStart CGSL MAIN 7.02 : git Vulnerability (NS-SA-2026-0105)

The remote NewStart CGSL host, running version MAIN 7.02, has git packages installed that are affected by a vulnerability: - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When...

Gitea: Remote Code Execution via diffpatch Git Hook Installation

Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain th...

Malicious code in cv-train (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e63e889d2bfc807902ef5bcd86b6d65b95272587726dda61e4efb63d461fc3b setup.py defines a phonehome function invoked at module top level, so it runs during pip install. The function collects the machine hostname, usernam...

CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2024-11080 Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2024-11080 Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

EUVD-2024-55751

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks WordPress plugin (versions 2.2.32 to 2.3.1 ) contains an Unauthenticated Hook Injection flaw via several functions in ~/includes/blocks/form-wrap/function.php, allowing unauthenticated attackers to execute actions through WordPress hooks when no ad...

PT-2026-86366

Name of the Vulnerable Software and Affected Versions ComboBlocks versions 2.2.32 through 2.3.1 Description The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress contains an Unauthenticated Hook Injection flaw. This issue occurs through several functions within the...

CVE-2024-11080: Improper Control of Generation of Code

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2026-76169

fastify versions = 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches...

CVE-2026-71216

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

CVE-2026-71216 Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

CVE-2026-71216

Apache SkyWalking (versions 9.6.0 through 11.0.0) is vulnerable to the cleartext transmission of sensitive information. The PagerDuty alarm hook transmits the integration routing key over unencrypted HTTP. Although PagerDuty serves this endpoint over HTTPS and provides a redirect for plain HTTP, ...

Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

CVE-2026-71216: Cleartext Transmission of Sensitive Information

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

VulnCheck KEV: CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...