CVE-2026-8983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6smphxx22y 2026-07-21 22:08:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6t3pjvux23 2026-07-22 01:30:28+00:00| seen|...

EUVD-2026-41643

Gitea: Git LFS object reuse allows non-Code access to authorize private source objects...

CVE-2026-64877

creationtimestamp| type| source ---|---|--- 2026-07-21 19:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6lowlm3s2i 2026-07-21 20:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr6lxd6i4z2a 2026-07-21 23:47:46+00:00| seen|...

CVE-2026-16493

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

EUVD-2026-46336

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

CVE-2026-16493

The CVE-2026-16493 entry describes a command-injection vulnerability in ansible-core where _extract_collection_from_git() builds git clone commands without a proper end-of-options separator, allowing an attacker to craft a collection source URI that injects payloads during ansible-galaxy collecti...

Arbitrary Argument Injection

Overview ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load...

CVE-2026-15793

CVE-2026-15793 affects BuildKit-based workflows using the raw low‑level API. When a Git source is checked out with git.checkoutbundle=true, and the source is malicious, this can trigger a crafted command invocation on the host. Affected component: BuildKit custom frontends/clients (low‑level API ...

EUVD-2026-46312

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15793 Git source checkout from a bundle file could lead to command injection

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-8933

creationtimestamp| type| source ---|---|--- 2026-07-21 15:08:09+00:00| seen| https://bsky.app/profile/arc-codex.com/post/3mr63m2s54b2k 2026-07-21 15:23:47+00:00| seen| https://bsky.app/profile/arc-codex.com/post/3mr64hz2xco2g 2026-07-21 15:36:50+00:00| seen|...

Malicious Package

Overview wallet-scanner-pro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview xfoofoox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview xwormclient is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview win32evtlogutil is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-16410

creationtimestamp| type| source ---|---|--- 2026-07-21 14:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5ybdqjnl27 2026-07-21 14:09:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5ydnufyb2j 2026-07-22 04:47:57+00:00| seen|...

CVE-2026-6792

creationtimestamp| type| source ---|---|--- 2026-07-21 14:06:39+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5y63a6gi2c 2026-07-21 14:50:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr62mqyiss2s...

SUSE CVE-2026-46671

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted .onetoc2 table-of-contents file can cause Parser::parsenotebook to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads ent...