The vulnerability of the arm64/boot/dts/xilinx/zynqmp.dtsi component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the arm64/boot/dts/xilinx/zynqmp.dtsi component of the Linux operating system’s kernel is related to the absence of resource initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

SUSE CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

OPENSUSE-SU-2026:21621-1 Security update for git-lfs

This update for git-lfs fixes the following issues: Changes in git-lfs: - update to 3.7.1: boo1252259 CVE-2025-26625 This release introduces security fixes for Linux, macOS, and Windows systems, which have been collectively assigned CVE-2025-26625. When populating a Git repository's working tree...

DEBIAN-CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-54623

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54623

django CMS prior to 5.0.8 is vulnerable to a denial-of-service via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without rejecting a plugin's own identifier or a descendant identifier, allowing a staff user with plugin-c...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-54623 django CMS: Plugin move endpoint allows cyclic reparenting (DoS)

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

CVE-2026-72847 broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

PT-2026-79075

Name of the Vulnerable Software and Affected Versions broot affected versions not specified Description broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process...

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...

Linux Distros Unpatched Vulnerability : CVE-2026-76219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that...

CVE-2026-72847: Improper Neutralization of Escape, Meta, or Control Sequences

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...

Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree,...

CVE-2026-76219

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...

CVE-2026-76219 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...

CVE-2026-76219

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...