Red Hat Security Advisory

RHSA-2026:74644

satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

Released 2026-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9

Fixes 2 records

TI-2026-54691 CVE-2026-78679 · GHSA-3wxw-xv34-2frg

GitPython before 3.1.59 Arbitrary File Read via TagReference.create

MEDIUM 64

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00316 Published 2026-08-25 Partial fix · 3.1.59 CWE-73

TI-2026-59934 CVE-2026-87817 · GHSA-239g-whfq-7xj9

GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

MEDIUM 46

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00419 Published 2026-09-09 Partial fix · 3.1.60 CWE-94