290 matches found
CVE-2026-68754 Publishers without delete permission can overwrite docker layer information
A repository publisher without delete permission may modify protected package content under specific conditions...
pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
CVE-2026-12701
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
EUVD-2026-45954
A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...
galaxy-ng (>=4.6.0, <=4.6.6), pulp-rpm (>=3.17.6, <=3.17.22) +1 more potentially affected by CVE-2026-0994 via protobuf (4.22.0rc3)
protobuf PYPI version 4.22.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - galaxy-ng =4.6.0, =3.17.6, =3.21.0, =3.21.36 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...
galaxy-ng (>=4.2.0a3, <=4.9.2), pulp-2to3-migration (>=0.0.1rc1, <=0.17.0) +12 more potentially affected by CVE-2024-7143 via pulpcore (>=3.0.1, <=3.54.1)
pulpcore PYPI version =3.0.1, =4.2.0a3, =0.0.1rc1, =0.2.0b10, =0.1.0rc4, =1.0.0rc1, =0.1.0b5, =2.0.0b4, =0.1.0rc1, =0.1.0, =0.3.0, =0.1.0a1, =2.0.0a1, =3.0.0b9, =3.0.0, =3.27.0 Source cves: CVE-2024-7143 Source advisory: OSV:PYSEC-2026-1808...
PYSEC-2026-1808 Pulp incorrectly assigns RBAC permissions in tasks that create objects
A flaw was found in the Pulp package. When a role-based access control RBAC object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin typically the addrolesforobjectcreator method. This method finds the object creator by checking the current authenticated user...
galaxy-ng (>=4.2.0a3, <=4.6.6), pulp-ansible (>=0.2.0b10, <=0.6.2) potentially affected by CVE-2023-5189 via galaxy-importer (>=0.1.1, <=0.4.9)
galaxy-importer PYPI version =0.1.1, =4.2.0a3, =0.2.0b10, =0.6.2 Source cves: CVE-2023-5189 Source advisory: OSV:PYSEC-2026-1401...
Plaintext storage of tokens in pulp_ansible
The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API instead of marking it as write only...
galaxy-ng (>=4.2.0a3, <=4.5.5) potentially affected by CVE-2022-3644 via pulp-ansible (>=0.2.0b15, <=0.13.6)
pulp-ansible PYPI version =0.2.0b15, =4.2.0a3, =4.5.5 Source cves: CVE-2022-3644 Source advisory: OSV:PYSEC-2026-900...
PYSEC-2026-900 Plaintext storage of tokens in pulp_ansible
The collection remote for pulpansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API instead of marking it as write only...
Galaxy NG: command injection vulnerability
A command injection vulnerability was found in galaxyng. The dogitcheckout function in the legacy role import API v1 interpolates unsanitized git ref names branch/tag names into shell commands executed via subprocess.run with shell=True. An authenticated user who controls a git repository can...
CVE-2026-12398
A command injection vulnerability was found in galaxyng. The dogitcheckout function in the legacy role import API v1 interpolates unsanitized git ref names branch/tag names into shell commands executed via subprocess.run with shell=True. An authenticated user who controls a git repository can...
EUVD-2026-37124
A command injection vulnerability was found in galaxyng. The dogitcheckout function in the legacy role import API v1 interpolates unsanitized git ref names branch/tag names into shell commands executed via subprocess.run with shell=True. An authenticated user who controls a git repository can...
CVE-2026-12398: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability was found in galaxyng. The dogitcheckout function in the legacy role import API v1 interpolates unsanitized git ref names branch/tag names into shell commands executed via subprocess.run with shell=True. An authenticated user who controls a git repository can...
PT-2026-49716
Name of the Vulnerable Software and Affected Versions galaxy ng affected versions not specified Description A command injection issue exists in the legacy role import API v1 where the do git checkout function interpolates unsanitized git ref names, such as branch or tag names, into shell commands...
[SECURITY] Fedora 43 Update: python-pulp-glue-0.37.0-5.fc43
pulp-glue is a library to ease the programmatic communication with the Pulp3 API. It helps to abstract different resource types with so called contexts and allows to build or even provides complex workflows like chunked upload or waiting on tasks. It is built around an openapi3 parser to provide...
[SECURITY] Fedora 44 Update: python-pulp-glue-0.37.0-5.fc44
pulp-glue is a library to ease the programmatic communication with the Pulp3 API. It helps to abstract different resource types with so called contexts and allows to build or even provides complex workflows like chunked upload or waiting on tasks. It is built around an openapi3 parser to provide...
