CVE-2026-89683: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup nfsdsetfhdentry leaks the dentry reference from exportfsdecodefhraw when the NFS3FHSIZE or NFSFHSIZE switch cases detect NFSEXPV4ROOT and goto out. The out: label calls...

PT-2026-90548

Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107290)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107290 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst cache for...

EUVD-2026-75710

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011

isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

SummaryGitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns a...

CVE-2026-89011: Improperly Controlled Modification of Object Prototype Attributes

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

GHSA-HR3M-4QWQ-3MGC GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053316 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insertdelayedref if we ne...

CVE-2026-85626

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-80775

In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm-futex.phash.ref allocation futexhashallocate allocates mm-futex.phash.ref without any locking. Commit d9b05321e21e "futex: Move futexhashfree back to mmput" moved the allocation here and assumed...

CVE-2026-85626

git-mcp-server 2.15.1 is affected by an argument injection vulnerability in the ref and object parameters of the git_log, git_diff, and git_show tools. The root cause is a lack of leading-dash validation , allowing attackers to inject git command-line options such as --output= and write files out...

CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints

A flaw was found in Apache Tomcat. This improper authorization vulnerability occurs because security-role-ref definitions are incorrectly used as role aliases within the Realm, in addition to their correct usage with Request.isUserInRole. This misconfiguration allows for a bypass of declarative...

NPM: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

NPM: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref vulnerability discovered by ? in WordPress Npm orval versions 8.22.0...

GHSA-CXQ5-97V7-87J8 Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Summary Orval resolves OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF...

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Summary Orval resolves OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF...