CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

CVE-2026-76218

GitPython before 3.1.58 has an RCE flaw in Repo.init that passes unvalidated git options, allowing attackers to inject a template directory with malicious hooks executed during subsequent git operations. Affected libraries should upgrade to 3.1.58 or later; no in-the-wild exploitation is reported...

Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

SummaryThe Glances action system lets an administrator configure shell commands that runwhen a monitoring threshold is crossed. The command is a Mustache template whosevariables are filled with runtime stat fields such as a process name, a containername or a filesystem mount point. Those fields a...

BIT-GOLANG-2026-56858 Fix Javascript regexp context tracking in html/template

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

OPENSUSE-SU-2026:21592-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

CVE-2026-75979

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...

EUVD-2026-62215

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...

CVE-2026-75979 xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...

CVE-2026-75979 xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...

CVE-2026-75979

EasyReport ≤ 2.0.17.0522_Beta is vulnerable in DesignerController.java (execSqlText/previewSqlText functions) via the sqlText argument, causing improper neutralization of special elements in a template engine. Attack is remote with low privileges; CVSS 6.3 MEDIUM. Public PoC exists; project unres...

CVE-2026-75979 xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...

PT-2026-78556

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a schema default is emitted into a...

PT-2026-78555

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a query parameter default is emitted into...

CVE-2026-72716: Improper Neutralization of Special Elements Used in a Template Engine

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

PT-2026-78253

Name of the Vulnerable Software and Affected Versions xianrendzw EasyReport versions prior to 2.0.17.0522 Beta Description Improper neutralization of special elements used in a template engine occurs within the SQL Preview Endpoint component. A remote attacker can manipulate the sqlText argument ...

CVE-2026-76218: Improper Neutralization of Argument Delimiters in a Command

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

CVE-2026-75979: Improper Neutralization of Special Elements Used in a Template Engine

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements...

PT-2026-80730

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

PT-2026-78436

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...

PT-2026-80736

Name of the Vulnerable Software and Affected Versions document-merge-service versions prior to 9.1.0 Description Remote code execution is possible through server-side template injection SSTI, a flaw where an application improperly handles template inputs, allowing an attacker to inject and execut...