Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 84 available sources using the dropdown above.
OSV Homebrew πΊ is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| brew-waybackpy-cve-2026-44432 | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | 2026-08-13T17:49:05Z | 2026-09-17T20:11:11Z |
| brew-waybackpy-cve-2023-45803 | urllib3's request body not stripped after redirect from 303 status changes request method to GET | 2026-08-13T17:49:05Z | 2026-09-17T20:11:11Z |
| brew-waybackpy-cve-2023-43804 | `Cookie` HTTP header isn't stripped on cross-origin redirects | 2026-08-13T17:49:05Z | 2026-09-17T20:11:11Z |
| brew-xxh-cve-2020-14343 | Improper Input Validation in PyYAML | 2026-08-13T17:54:46Z | 2026-09-17T20:10:48Z |
| brew-snakemake-cve-2026-78679 | GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251) | 2026-09-10T01:16:34Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-78678 | GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() | 2026-09-04T10:04:58Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-78677 | GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination | 2026-09-04T10:04:58Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-78676 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE | 2026-09-04T10:04:58Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-78675 | GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes) | 2026-09-04T10:04:58Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73625 | GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73624 | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled) | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73623 | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73622 | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73621 | GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73620 | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-73619 | GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive() | 2026-08-14T09:39:19Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-69097 | GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) | 2026-08-13T17:34:41Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-67326 | GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-67325 | GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist | 2026-08-13T17:34:41Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-67324 | GitPython unsafe clone option gate bypass through joined short options | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-67323 | GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()` | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-67322 | GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-44432 | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-44431 | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-44244 | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-44243 | GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-42284 | GitPython: Unsafe option check validates multi_options before shlex.split transformation | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-42215 | GitPython has Command Injection via Git options bypass | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2026-21441 | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |
| brew-snakemake-cve-2025-66418 | urllib3 allows an unbounded number of links in the decompression chain | 2026-08-13T17:34:42Z | 2026-09-17T20:10:37Z |