Posted by Thomas Wolf on Sep 29 Severity: moderate CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected versions: - Apache MINA SSHD before 2.20.0 - Apache MINA SSHD 3.0.0-M1 before 3.0.0-M6 Description: Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class...
CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/1007
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
Posted by Hussein Awala on Oct 26 Severity: low Affected versions: - Apache Airflow SSH provider 4.3.0 before 7.0.1 Description: In apache-airflow-providers-ssh before…
CVE-2026-112818: git-annex cross-repository data exfiltration
Posted by Joey Hess on Oct 26 I have released git-annex 10.20261026, which fixes a cross-repository data exfiltration attack. https://git-annex.branchable.com/download/…
Brotli CVE-2026-111497 and git-remote-https
Posted by Harry Sintonen on Oct 26 I haven't seen this mentioned here, yet: git https remote (git-remote-https) is vulnerable to CVE-2026-111497, too, when libcurl has…
Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)
Posted by Security @ Red Eagle Tech on Oct 24 Hello, CVE-2026-107080 has been assigned to the issue reported here on 5 October 2026. MITRE's description: OpenJPEG 2.4.0…
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…
Gitea security advisory (AV26-845) - Update 1
Serial Number: AV26-845 Date: August 25, 2026 Updated: October 20, 2026 As of August 14, 2026, Gitea is affected by vulnerabilities in the following product: Gitea Prior…