CVE-2026-71365

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

EUVD-2026-61015

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

zabbix-threat-control v3.1.0

Zabbix Threat Control ztc Turn the Zabbix you already run into a vulnerability-management console. ztc reads each host's software inventory through the stock zabbix-agent2 no extra agent to deploy, audits it against Vulners, and pushes scored, per-host findings — problems, dashboards and CVSS...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to loss of confidentiality due to CVE-2026-47423

Summary Node.js module DOMPurify is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in Node.j...

CVE-2026-71365

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

CVE-2026-75913

CodeWhale versions 0.8.41–0.8.63 pass an unvalidated model-supplied rev parameter directly to git show argv without an --end-of-options sentinel, allowing a --output= value to be interpreted as a git flag. Combined with the auto-approved, read-only git_show tool and prompt injection, this enables...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

EUVD-2026-60971

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75912

CodeWhale's git_blame tool passes an unvalidated rev parameter directly to git, allowing attackers to inject options like --contents=/path/to/file to exfiltrate sensitive files (SSH keys, credentials) via tool output. CVSS 3.1 score 7.4 (High). Fixed in CodeWhale 0.8.64. No in-the-wild exploitati...

CVE-2026-75912

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

EUVD-2026-60970

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-71539

n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a...

mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

mysql: Clone Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...