DEBIAN-CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

AZL-96950 CVE-2026-63387 affecting package libevent 2.1.12-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check...

EUVD-2026-63488

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2025-14602

vsDesk generates uploaded file names using a predictable timestamp-based method, allowing remote attackers to guess filenames and access uploaded files. Patched in version 14.0101; CVSS 4.0 scores it MEDIUM (5.3). No in-the-wild exploitation reported. Patch available from https://vsdesk.ru/. Advi...

PT-2026-79201

Name of the Vulnerable Software and Affected Versions Azure Arc affected versions not specified Description An issue involving the use of an incorrectly-resolved name or reference allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

PT-2026-79075

Name of the Vulnerable Software and Affected Versions broot affected versions not specified Description broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process...

UBUNTU-CVE-2026-76221

GitPython before 3.1.58 contains a config-name injection vulnerability...

PT-2026-79192

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description An issue exists where the software fails to escape the meetingName variable in the record-and-playback/screenshare/playback/index.html.erb file during the generation of the screenshare playbac...

CVE-2026-68900

creationtimestamp| type| source ---|---|--- 2026-08-19 21:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthmtw75wv2t...

Snipe-IT: Stored DOM XSS via table selected-count IDs

Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded...

EUVD-2026-62626

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

CVE-2026-44829 Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives...

DEBIAN-CVE-2026-65611

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

EUVD-2026-62471

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76222 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...

EUVD-2026-62462

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...