SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

CVE-2026-66062

### Impact SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The i

历史摘要 · 未重新核验 · GitHub Advisory

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

### Impact When a Nuxt dev server is bound to a network-reachable interface (for example `nuxt dev --host` for on-devic

历史摘要 · 未重新核验 · GitHub Advisory

go-git: Malicious reference names may modify files outside the reference storage

CVE-2026-71557

### Impact A path traversal issue in `go-git` could allow malicious reference names to access files outside the reposito

历史摘要 · 未重新核验 · GitHub Advisory

go-git: Worktree operations may follow symlinks

CVE-2026-71556

## Impact A symlink traversal issue in `go-git` could allow worktree operations to modify files outside the intended wo

历史摘要 · 未重新核验 · GitHub Advisory

ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer

CVE-2026-68772

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attacke

历史摘要 · 未重新核验 · OSV.dev

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

## Summary The `check_unsafe_options` guard can be bypassed on every guarded method (clone/clone_from, fetch/pull/push,

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

## Summary GitPython's config-name validator only neutralizes CR/LF/NUL for the `"option"` label; it does not reject `=`

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

### Summary GitPython computes the on-disk location of a submodule's separate Git directory (`.git/modules/`) from the s

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

## Summary `IndexFile.remove()` and `Head.checkout()` forward `**kwargs` into `git rm` and `git checkout` with no guard

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

## Summary `Repo.init()` forwards `**kwargs` verbatim to `git init` with no unsafe-option guard and no `allow_unsafe_opt

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

## Summary `IndexFile.from_tree`, `IndexFile.reset` (→ from_tree) and `IndexFile.merge_tree` append caller-influenced tr

历史摘要 · 未重新核验 · GitHub Advisory

Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that...

CVE-2022-4995

Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthent

历史摘要 · 未重新核验 · GitHub Advisory

Postiz is an open-source social media scheduling tool. The route that serves locally stored media...

CVE-2026-19264

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied pat

历史摘要 · 未重新核验 · GitHub Advisory

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0...

CVE-2026-66914

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated

历史摘要 · 未重新核验 · GitHub Advisory

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an...

CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0....

CVE-2026-19207

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some

历史摘要 · 未重新核验 · GitHub Advisory

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1...

CVE-2026-18497

A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is used for p

历史摘要 · 未重新核验 · GitHub Advisory

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline

历史摘要 · 未重新核验 · GitHub Advisory

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path...

CVE-2026-56794

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A lo

历史摘要 · 未重新核验 · GitHub Advisory

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass...

CVE-2026-16637

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlis

历史摘要 · 未重新核验 · GitHub Advisory