AlmaLinux 9.2 [TuxCare] Security Update: hostapd / hostapd-logwatch (ALMALINUX9.2:CLSA-2026:1781274016)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781274016 advisory. - In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully...

AlmaLinux 9.6 [TuxCare] Security Update: mod_dav_svn / python3-subversion / subversion / subversion-devel / etc (ALMALINUX9.6:CLSA-2026:1778495013)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778495013 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...

CentOS Linux 8 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS-STREAM8:CLSA-2025:1756489732)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2025:1756489732 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows...

CentOS Linux 6 [TuxCare] Security Update: mod_dav_svn / subversion / subversion-devel / subversion-gnome / etc (CENTOS6:CLSA-2026:1777038917)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777038917 advisory. - A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 t...

Weblate: Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.

A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metada...

Astra Linux – Vulnerability in Apache2

A NULL pointer dereference in moddavlock in the Apache HTTP Server 2.4.66 and earlier versions may allow an attacker to crash the server with a malicious request. moddavlock is not used internally by moddav or moddavfs. The only known use-case for moddavlock was in moddavsvn from Apache Subversio...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible 2.7.16 and earlier versions, as well as 2.8.8 and earlier, and 2.9.5 and earlier. When a password is set using the “password” argument of the svn module, it is used in the svn command line, thereby exposing it to other users within the same node. An attacker could...

Astra Linux – Vulnerability in Subversion

Subversion’s moddavsvn is vulnerable to memory corruption. When checking path-based authorization rules, moddavsvn servers may attempt to use memory that has already been freed. Affected Subversion moddavsvn servers include versions 1.10.0 through 1.14.1 including those versions. Servers that do...

Photon OS 5.0: Subversion PHSA-2025-5.0-91-0519

An update of the subversion package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0519. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting Detection

Jira Subversion ALM for Enterprise before 8.8.2 contains a cross-site scripting vulnerability at multiple locations. !/usr/bin/env python3 -- coding: utf-8 -- """Jira Subversion ALM for Enterprise before 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

JLSEC-2026-647 It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation...

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion storedframe. Stored frames can later be referenced by FTCH chunks. For files using subversion storedframe. Leaving ctx-hasdimensions set to false. A subsequent chunk with type...

GO-2026-5624 Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast

Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast...

io.jenkins.plugins:pipeline-lib-oras (>=84.vcfdc020586ef, <=90.vecb_55543088a), org.jenkins-ci.plugins:changelog-history (1.4) +2 more potentially affected by CVE-2026-57283 via io.jenkins.plugins:pipeline-groovy-lib (787.ve2fef0efdca_6)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 787.ve2fef0efdca6 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:pipeline-lib-oras =84.vcfdc020586ef,...

io.jenkins.plugins:pipeline-lib-oras (>=84.vcfdc020586ef, <=90.vecb_55543088a), org.jenkins-ci.plugins:changelog-history (1.4) +2 more potentially affected by CVE-2026-57284 via io.jenkins.plugins:pipeline-groovy-lib (787.ve2fef0efdca_6)

io.jenkins.plugins:pipeline-groovy-lib MAVEN version 787.ve2fef0efdca6 is affected by a known vulnerability. The following packages have a transitive dependency on io.jenkins.plugins:pipeline-groovy-lib and may be impacted: - io.jenkins.plugins:pipeline-lib-oras =84.vcfdc020586ef,...

ShellGames: Speculative LLM-Driven SSH Deception

Cyber deception and Moving Target Defense are promising strategies that aim to disrupt adversaries by increasing uncertainty. However, sustaining long-lived, credible interactive sessions with adversaries remains an open challenge. Large Language Models LLMs offer a promising path toward more...

CLSA-2026-1778946135 subversion: Fix of CVE-2018-11782

CVE-2018-11782: fix svnserve DoS via well-formed read-only get-deleted-rev request...

subversion: Fix of CVE-2018-11782

CVE-2018-11782: fix svnserve DoS via well-formed read-only get-deleted-rev request...

CLSA-2026-1778894989 subversion: Fix of CVE-2021-28544

CVE-2021-28544: fix authz copyfrom path information leak in svn log -v...

CLSA-2026-1778495013 subversion: Fix of CVE-2024-46901

CVE-2024-46901: fix moddavsvn denial-of-service via control characters in paths...

Unity Linux 20.1060e / 20.1070e Security Update: subversion (UTSA-2026-017632)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017632 advisory. Subversion's modauthzsvn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a...