Posted by Joey Hess on Oct 26 I have released git-annex 10.20261026, which fixes a cross-repository data exfiltration attack. https://git-annex.branchable.com/download/ There are also backported patches for several past versions available as branches in the git repository: CVE-2026-112818-patch-10.20250416 CVE-2026-112818-patch-10.20251029 CVE-2026-112818-patch-10.20261006...
CVE-2026-112818: git-annex cross-repository data exfiltration
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/394
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Brotli CVE-2026-111497 and git-remote-https
Posted by Harry Sintonen on Oct 26 I haven't seen this mentioned here, yet: git https remote (git-remote-https) is vulnerable to CVE-2026-111497, too, when libcurl has…
Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)
Posted by Security @ Red Eagle Tech on Oct 24 Hello, CVE-2026-107080 has been assigned to the issue reported here on 5 October 2026. MITRE's description: OpenJPEG 2.4.0…
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…
Gitea security advisory (AV26-845) - Update 1
Serial Number: AV26-845 Date: August 25, 2026 Updated: October 20, 2026 As of August 14, 2026, Gitea is affected by vulnerabilities in the following product: Gitea Prior…
Fwd: Announcing FreeType version 2.15.0
Posted by Alan Coopersmith on Oct 12 While the notes below only mention the fix for CVE-2026-95512, the CVE record for CVE-2026-50811 also lists a commit included in…
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git
Posted by Andrea Cosentino on Oct 09 Severity: CVSS 3.1: 8.8 (high) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected versions: - Apache Camel Karavan 3.18.0 before…