AlmaLinux 9 : rust (ALSA-2026:67285)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67285 advisory. libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server CVE-2026-53587 Tenable has extracted the preceding description block...

PT-2026-92100

Name of the Vulnerable Software and Affected Versions gitoxide gix-transport versions prior to 0.59.2 Description The software fails to filter control characters in git-daemon connect requests. This allows attackers to inject NUL, CR, or LF bytes through specially crafted git URLs. Such injection...

Linux Distros Unpatched Vulnerability : CVE-2026-91986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted...

RockyLinux 8 : git-lfs (RLSA-2026:67161)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

FreeBSD : git-lfs -- Improper Link Resolution Before File Access (107f9dad-b05c-11f1-9369-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 107f9dad-b05c-11f1-9369-b42e991fc52e advisory. https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5 reports: Git LFS is a Git...

RockyLinux 9 : rust (RLSA-2026:67285)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67285 advisory. libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server CVE-2026-53587 Tenable has extracted the preceding description block...

CVE-2026-91986: Improper Neutralization of Special Elements in Output Used by a Downstream Component

gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted git URLs. Attackers can inject extra NUL-delimited protocol fields to spoof virtual hosts or inject newlines into daemon requests and lo...

MiracleLinux 8 : git-lfs-3.4.1-13.el8_10 (AXSA:2026-1833:12)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1833:12 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

AlmaLinux 10 : rust (ALSA-2026:67286)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67286 advisory. libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server CVE-2026-53587 Tenable has extracted the preceding description block...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.3 (AXSA:2026-1842:13)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1842:13 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

PT-2026-91832

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

CVE-2026-88765: Improper Neutralization of Special Elements used in a Command

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicod...

CVE-2026-91993: Authorization Bypass Through User-Controlled Key

Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to access repositories from other workspaces. Attackers can submit repository identifiers from different workspaces to enumerate repository...

CVE-2026-91923: Server-Side Request Forgery (SSRF)

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

OESA-2026-3733 git security update

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce, and...

Exploit for Code Injection in Gitea

CVE-2026-60004: Gitea Diffpatch API Remote Code Execution...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...