WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product git✕
Overview 869 matches · 72 in Waratek scope · 14 protected · 10 exploited · 5 CISA KEV · 50 public PoC · 25 EPSS ≥ 0.5
869matches 72in Waratek scope8.3% 14protected1.6% 10exploited1.2% 5CISA KEV0.6% 50public PoC5.8% 25EPSS ≥ 0.52.9%
Protected by Waratek 14 1.6% Rule in development 0 0.0% Mitigation candidate 4 0.5% No exploit published 54 6.2% Outside Waratek scope 2 0.2% Not applicable 795 91.5% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 869 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 14 1.6% partly blocked 0 0.0% not blocked 855 98.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 10 1.2% Working exploit published 38 4.4% Proof of concept only 93 10.7% Forecast only 9 1.0% No public exploit 719 82.7%
split by peak 176 / year
Not applicable: 795Outside Waratek scope: 2No exploit published: 54Mitigation candidate: 4Protected by Waratek: 14 High: 869 not blocked: 855blocked by ARMR today: 14 No public exploit: 719Forecast only: 9Proof of concept only: 93Working exploit published: 38Exploited: 10
19981 Not applicable1 High1 not blocked1 No public exploit1 19990 20000 20011 Not applicable1 High1 not blocked1 No public exploit1 20020 20031 Not applicable1 High1 not blocked1 Working exploit published1 20041 Not applicable1 High1 not blocked1 Working exploit published1 20053 Not applicable3 High3 not blocked3 No public exploit3 20064 Not applicable4 High4 not blocked4 Working exploit published2 No public exploit2 20077 Not applicable7 High7 not blocked7 Exploited1 Working exploit published3 No public exploit3 20087 Not applicable7 High7 not blocked7 Working exploit published3 No public exploit4 20097 Not applicable7 High7 not blocked7 Working exploit published4 No public exploit3 20107 Not applicable7 High7 not blocked7 Working exploit published2 No public exploit5 20114 Not applicable4 High4 not blocked4 Working exploit published3 No public exploit1 20122 Not applicable2 High2 not blocked2 No public exploit2 20131 Not applicable1 High1 not blocked1 No public exploit1 20145 Not applicable5 High5 not blocked5 Working exploit published2 No public exploit3 20155 Not applicable5 High5 not blocked5 Working exploit published3 No public exploit2 20164 Not applicable4 High4 not blocked4 No public exploit4 201732 Protected by Waratek1 No exploit published1 Not applicable30 High32 blocked by ARMR today1 not blocked31 Exploited1 Working exploit published3 No public exploit28 201840 Mitigation candidate1 No exploit published1 Not applicable38 High40 not blocked40 Exploited2 Proof of concept only1 Forecast only1 No public exploit36 201963 Protected by Waratek1 No exploit published5 Not applicable57 High63 blocked by ARMR today1 not blocked62 Working exploit published4 Proof of concept only1 No public exploit58 2020102 Protected by Waratek2 Mitigation candidate1 No exploit published12 Not applicable87 High102 blocked by ARMR today2 not blocked100 Working exploit published1 Proof of concept only1 Forecast only1 No public exploit99 202167 Protected by Waratek1 No exploit published10 Outside Waratek scope1 Not applicable55 High67 blocked by ARMR today1 not blocked66 Exploited2 Working exploit published1 Forecast only2 No public exploit62 202272 Protected by Waratek5 Mitigation candidate1 No exploit published4 Not applicable62 High72 blocked by ARMR today5 not blocked67 Exploited1 Working exploit published3 Proof of concept only8 Forecast only2 No public exploit58 202381 Protected by Waratek1 Mitigation candidate1 No exploit published5 Not applicable74 High81 blocked by ARMR today1 not blocked80 Exploited1 Working exploit published2 Proof of concept only29 Forecast only2 No public exploit47 202464 Protected by Waratek1 No exploit published6 Not applicable57 High64 blocked by ARMR today1 not blocked63 Proof of concept only4 Forecast only1 No public exploit59 2025112 Protected by Waratek1 No exploit published9 Not applicable102 High112 blocked by ARMR today1 not blocked111 Exploited1 Proof of concept only16 No public exploit95 2026176 Protected by Waratek1 No exploit published1 Outside Waratek scope1 Not applicable173 High176 blocked by ARMR today1 not blocked175 Exploited1 Proof of concept only33 No public exploit142
1999200220052008201120142017202020232026
869 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 9 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16255 High 2026-10-22 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.
CVE-2026-15723 High 2026-10-22 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
CVE-2026-112212 High 2026-10-22 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
CVE-2026-96893 High 2026-10-13 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.
CVE-2026-92883 High 2026-10-13 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.
CVE-2026-81839 High 2026-10-13 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.
CVE-2026-16301 High 2026-10-13 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
CVE-2026-14814 High 2026-10-13 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.
CVE-2026-96580 High 2026-10-06 Not applicable No public exploit Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion.
CVE-2026-96404 High 2026-10-06 Not applicable No public exploit When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its password. If the account is an administrator, the session grants full administrative access, including changing the account's password. Databases with a single user also did not require the reinstall confirmation.
CVE-2026-96399 High 2026-10-06 Not applicable No public exploit A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users.
CVE-2026-89430 High 2026-10-06 Not applicable No public exploit Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.
CVE-2026-86684 High 2026-10-06 Not applicable No public exploit The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
CVE-2026-79960 High 2026-10-06 Not applicable No public exploit When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner.
CVE-2026-70357 High 2026-10-06 Not applicable No public exploit Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.
CVE-2026-57554 High 2026-10-06 Not applicable No public exploit Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
CVE-2026-57545 High 2026-10-06 Not applicable No public exploit Memory corruption when processing draw objects of incorrect type during graphics command list execution.
CVE-2026-25302 High 2026-10-06 Not applicable No public exploit Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
CVE-2026-25291 High 2026-10-06 Not applicable No public exploit Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
CVE-2026-105267 High 2026-10-06 Not applicable No public exploit The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release deletion and did not check that the target was a plain tag. A collaborator with Code write access and without Releases write access could permanently delete published releases of that repository, including their attachments. Protected tag rules covering the release tag still blocked the deletion.
CVE-2026-104636 High 2026-10-06 Not applicable No public exploit Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.
CVE-2026-104632 High 2026-10-06 Not applicable No public exploit Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.
CVE-2026-104626 High 2026-10-06 Not applicable No public exploit A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.
CVE-2026-103670 High 2026-10-06 Not applicable No public exploit When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind.
CVE-2026-101027 High 2026-10-06 Not applicable No public exploit When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass `ALLOW_LOCALNETWORKS = false`, reaching internal services from the Gitea server. Instances without `ALLOWED_DOMAINS` configured are not affected by this specific bypass.
CVE-2026-84739 High 2026-09-29 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.
CVE-2026-102826 High 2026-09-29 Not applicable Proof of concept only simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and the initial remediation does not cover includeIf.<condition>.path, allowing the same file-loading primitive through a conditional include. A loaded configuration can set an executable Git option such as core.sshCommand, which Git invokes during the clone operation with the privileges of the Node.js process. Exploitation requires the application to pass attacker-influenced custom arguments and requires an attacker-controlled file that the process can read. This issue is fixed in 4.0.0.
CVE-2026-92470 High 2026-09-24 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.
CVE-2026-25278 High 2026-09-17 Not applicable No public exploit Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
CVE-2026-25275 High 2026-09-17 Not applicable No public exploit Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-79708 High 2026-09-16 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient scope validation.
CVE-2026-78252 High 2026-09-16 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.
CVE-2026-1168 High 2026-09-16 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
CVE-2025-14871 High 2026-09-16 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
CVE-2026-88765 High 2026-09-15 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.
CVE-2026-13210 High 2026-09-15 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.
CVE-2026-87819 High 2026-09-09 Not applicable No public exploit GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
CVE-2026-87818 High 2026-09-09 Not applicable Proof of concept only GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
CVE-2026-87817 High 2026-09-09 Not applicable No public exploit GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
CVE-2026-18252 High 2026-08-26 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.
CVE-2026-78678 High 2026-08-25 Not applicable Proof of concept only GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
CVE-2026-78677 High 2026-08-25 Not applicable Proof of concept only GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.
CVE-2026-78675 High 2026-08-25 Not applicable Proof of concept only GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
CVE-2026-10053 High 2026-08-23 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry.
CVE-2026-76222 High 2026-08-19 Not applicable Proof of concept only GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
CVE-2026-76221 High 2026-08-19 Not applicable No public exploit GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation.
CVE-2026-76220 High 2026-08-19 Not applicable No public exploit GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.
CVE-2026-76219 High 2026-08-19 Not applicable No public exploit GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.
CVE-2026-76218 High 2026-08-19 Not applicable No public exploit GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.
CVE-2026-76217 High 2026-08-19 Not applicable Proof of concept only GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
CVE-2026-19650 High 2026-08-17 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.
CVE-2026-73625 High 2026-08-13 Not applicable No public exploit GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
CVE-2026-73624 High 2026-08-13 Not applicable Proof of concept only GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.
CVE-2026-73623 High 2026-08-13 Not applicable Proof of concept only GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.
CVE-2026-73622 High 2026-08-13 Not applicable Proof of concept only GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
CVE-2026-73620 High 2026-08-13 Not applicable Proof of concept only GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.
CVE-2026-73619 High 2026-08-13 Not applicable Proof of concept only GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
CVE-2026-7427 High 2026-08-12 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.
CVE-2026-19228 High 2026-08-12 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.
CVE-2026-16494 High 2026-08-12 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.
CVE-2026-15423 High 2026-08-12 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.
CVE-2026-15217 High 2026-08-12 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.
CVE-2026-15216 High 2026-08-12 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.
CVE-2026-65675 High 2026-08-11 Not applicable No public exploit No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-25292 High 2026-08-04 Not applicable No public exploit Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.
CVE-2026-21366 High 2026-08-04 Not applicable No public exploit Memory corruption while processing a packet with a size close to the maximum allowed value.
CVE-2026-69097 High 2026-08-03 Not applicable Proof of concept only GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.
CVE-2026-67326 High 2026-08-01 Not applicable Proof of concept only GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged [core] section with hooksPath pointing to attacker-controlled directories, achieving remote code execution when git hooks are triggered.
CVE-2026-67325 High 2026-08-01 Not applicable Proof of concept only GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.
CVE-2026-67323 High 2026-08-01 Not applicable Proof of concept only GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
CVE-2026-67322 High 2026-08-01 Not applicable Proof of concept only GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.
CVE-2026-6267 High 2026-07-29 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.
CVE-2026-15975 High 2026-07-29 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.
CVE-2026-12436 High 2026-07-29 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.
CVE-2026-50510 High 2026-07-14 Not applicable No public exploit Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.
CVE-2026-58065 High 2026-07-13 Not applicable No public exploit The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.
CVE-2026-6896 High 2026-07-08 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.
CVE-2026-54528 High 2026-07-08 Not applicable Proof of concept only JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.
CVE-2026-13320 High 2026-07-08 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.
CVE-2026-21383 High 2026-07-06 Not applicable No public exploit Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.
CVE-2026-12053 High 2026-06-25 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows.
CVE-2026-10712 High 2026-06-25 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.
CVE-2026-10086 High 2026-06-25 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input.
CVE-2026-11745 High 2026-06-22 No exploit published Proof of concept only A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.
CVE-2025-66389 High 2026-06-22 Not applicable No public exploit GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.
CVE-2026-50519 High 2026-06-19 Not applicable No public exploit Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-8589 High 2026-06-11 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.
CVE-2026-7250 High 2026-06-11 Not applicable No public exploit GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.
CVE-2026-10087 High 2026-06-11 Not applicable No public exploit GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.
CVE-2026-21837 High 2026-06-05 Not applicable No public exploit HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.
CVE-2026-48827 High 2026-06-01 Protected by Waratek No public exploit Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.
CVE-2026-24092 High 2026-06-01 Not applicable No public exploit Memory Corruption when processing fastboot commands to set display mode.
CVE-2026-24091 High 2026-06-01 Not applicable No public exploit Memory corruption while processing fastboot commands with improperly formatted input.
CVE-2026-24090 High 2026-06-01 Not applicable No public exploit Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
CVE-2026-24089 High 2026-06-01 Not applicable No public exploit Memory corruption while processing fastboot commands with invalid input.
CVE-2026-24088 High 2026-06-01 Not applicable No public exploit Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
CVE-2026-24087 High 2026-06-01 Not applicable No public exploit Memory corruption while processing fastboot OEM commands.
CVE-2026-24085 High 2026-06-01 Not applicable No public exploit Memory Corruption when processing display command line information due to improper initialization of a variable.
CVE-2025-59606 High 2026-06-01 Not applicable No public exploit Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.
CVE-2025-59604 High 2026-06-01 Not applicable No public exploit Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
‹ prev page 1 of 9 next ›