CVE Vulnerability Catalog

GitPython's public Submodule.move() API verifies that its destination is lexically inside the parent repository, but does not reject symbolic links in the destination's intermediate components before filesystem operations. On systems that check out Git symlinks, an untrusted repository may exploit this.

The description of this report does not contain sufficient technical information about the vulnerability — it only includes a note about the reporting method and references to files that were not attached. The nature and scope of the issue cannot be determined from it.

Pillow (PIL) in EpsImagePlugin.py in Ghostscript() lets Ghostscript render past the decompression bomb limit when loading EPS with scale. This can lead to excessive resource consumption.

This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epo...

Repo._clone()'s handling of separate_git_dir never disables Git.polish_url()'s environment-variable expansion, unlike other callers of that helper that handle attacker-influenced data. separate_git_dir can be derived from an attacker-controlled .gitmodules submodule.

In GitPython, Remote.pull() forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec (e.g., a user-supplied branch name) may allow injection of unsafe options.

On Windows, attacker-controlled content in a wheel's .dist-info/namespace_packages.txt can cause setuptools' legacy wheel installation path to create an __init__.py outside the requested destination_eggdir. The attacker can influence the destination path but not the file contents.

Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates chaining to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue certificates.

GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> can inject configuration.

No detailed vulnerability description is available in the provided data. This entry refers to a Debian LTS security update (DLA).

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name.

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally.

Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.

NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.

LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. Third parties dispute this because the LLVM security policy excludes language front-ends for which a malicious input file can cause undesirable behavior.

llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. This may lead to application crashes.

llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). This may lead to application crashes.

Nodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-specific TLS `servername`. When two direct SMTPS transports use the same DNS host with different `tls.servername` values, the first transport's server name is returned to the second.

llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.". This may lead to application crashes.