CVE-2026-110860
Description détaillée
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.
Vecteur d'attaque (CVSS)
Dernières Vulnérabilités
CVE-2026-77931
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.
CVE-2026-76661
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
CVE-2026-76660
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.