27 matches found
ROS-20260817-73-0200
The vulnerability of the SetConfig method in the background service demon dnfdaemon is related to improper privilege management. Exploiting this vulnerability could allow an attacker to influence trusted package sources. Information about this vulnerability was obtained from an independent...
EUVD-2026-41635
Gitea has insufficient permission checks for Composer package source links...
Gitea has insufficient permission checks for Composer package source links
CVE Description Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information. Summary A critical vulnerability has been discovered in Gitea. It was already reported via...
CVE-2026-11386 ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...
CVE-2026-11386
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu-advantage-tools. The client constructs APT source files such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents using data received directly from the contract server response via...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via insufficient permission checks in the process handling Composer package source links. An attacker can gain unauthorized access to private or internal package source information by directly accessing these links...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via insufficient permission checks in the process handling Composer package source links. An attacker can gain unauthorized access to private or internal package source information by directly accessing these links...
CVE-2026-27771 Gitea Composer package source links use insufficient permission checks
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information...
CVE-2026-27771
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information...
CVE-2026-39958
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...
CVE-2026-39958
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...
CVE-2026-39958
The oma package manager for AOSC OS is vulnerable to a CRLF injection flaw prior to version 1.25.2 . The oma-topics component fetches metadata for testing repositories (topics) from remote servers but fails to check the name field in the metadata for transliteration. A malicious party can provide...
CVE-2026-39958
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...
CVE-2026-39958 oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...
PT-2026-31657
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...
Malicious code in cocoapod (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
EUVD-2024-19638
Malicious code in bioql PyPI...
CVE-2024-22034
Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...
