CVE-2026-68754

Publishers without delete permission can overwrite docker layer information

A repository publisher without delete permission may modify protected package content under specific conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68755

Bundle writers may alter trusted release information in JFrog Artifactory

A bundle writer may create misleading release promotion information under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68756

Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68757

Potential improper SAML signature verification in JFrog Artifactory

A user with access to a valid SAML response may impersonate another user under specific conditions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68760

Potential remember-me authentication bypass in JFrog Artifactory

An unauthenticated user may bypass authentication under specific cache conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68758

Authenticated users may access restricted Artifactory support information

A low-privileged authenticated user may access restricted support information under specific conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-68759

Integration credential holders may impersonate users in JFrog Access

A holder of a valid integration credential may impersonate other users under specific conditions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-76221

GitPython before 3.1.58 Config Injection via option-name

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-76222

GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Gitpython-developers Gitpython Project

Products

Gitpython Gitpython

CVE-2026-78675

GitPython before 3.1.59 Local File Content Disclosure via .gitmodules

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-84840

tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.5.1 is able to mitigate this issue. Upgrading the affected component is recommended.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Tsi-coop

Products

Tsi-dpdp-cms

CVE-2026-82641

Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Keploy

Products

Keploy

CVE-2026-82463

pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Pac4j

Products

Pac4j

CVE-2026-59285

Spring for GraphQL Unsafe Deserialization in pagination support

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring For Graphql Spring For Graphql

CVE-2026-54789

mod_auth_openidc has out-of-bounds read and write in state cookie parsing

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openidc

Products

Mod Auth Openidc

CVE-2026-38345

ffmpeg: FFmpeg: Denial of Service via division-by-zero vulnerability in `ff_sws_init_single_context` function.

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-37236

github.com/grpc-ecosystem/grpc-gateway: grpc-gateway: Access control bypass via X-HTTP-Method-Override header

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Grpc-ecosystem

Products

Grpc-gateway

CVE-2026-78676

GitPython before 3.1.59 Remote Code Execution via Config Injection

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-78677

GitPython before 3.1.59 Path Traversal via separate-git-dir

GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-12878

Codefresh: Codefresh: Privilege Escalation via API Endpoint

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Linux Microsoft Octopus and 1 more

Products

Linux Kernel Windows Codefresh and 1 more