CVE-2026-89011 isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

EUVD-2026-75710

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

PT-2026-89581

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing ' proto ' path segments during ref negotiation. Attackers controlling a Git...

SUSE CVE-2026-82250

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

AZL-98430 CVE-2026-82250 affecting package rust 1.90.0-10

gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the clien...

libgit2: libgit2: Denial of Service due to heap out-of-bounds read from malicious Git server

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...

CVE-2026-53587

A flaw was found in libgit2. A fixed-size string comparison in the setdata function within transports/smartpkt.c does not adequately verify the size of a network packet buffer. A remote attacker, operating a malicious Git server, can send a specially crafted packet-line capability buffer. This ca...

CVE-2026-62960: Exposure of Sensitive Information to an Unauthorized Actor

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

AZL-96968 CVE-2026-53587 affecting package libgit2 for versions less than 1.7.2-3

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

@adobe/git-server (>=1.0.1, <=1.0.5), @adobe/helix-cli (>=5.7.7, <=6.1.0) +30 more potentially affected by CVE-2026-73055 via shescape (>=1.6.1, <=2.1.14)

shescape NPM version =1.6.1, =1.0.1, =5.7.7, =2.16.1, =1.0.0, =0.1.3, =0.0.7, =0.1.0, =2.3.2, =2.3.2, =0.9.22, =2.5.3, =1.1.6, =2.2.3 - @w3sec/w3security-gradle-plugin 2.27.0 - @xeserv/nixexpr 0.1.0 and more Source cves: CVE-2026-73055 Source advisory: MEND:CVE-2026-73055...

@adobe/git-server (>=1.0.1, <=1.0.5), @adobe/helix-cli (>=5.7.7, <=6.1.0) +30 more potentially affected by CVE-2026-73414 via shescape (>=1.6.1, <=2.1.12)

shescape NPM version =1.6.1, =1.0.1, =5.7.7, =2.16.1, =1.0.0, =0.1.3, =0.0.7, =0.1.0, =2.3.2, =2.3.2, =0.9.22, =2.5.3, =1.1.6, =2.2.2 - @w3sec/w3security-gradle-plugin 2.27.0 - @xeserv/nixexpr 0.1.0 and more Source cves: CVE-2026-73414 Source advisory: MEND:CVE-2026-73414...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Bonobo Git Server Login Panel - Detect

Bonobo Git Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Bonobo Git Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bonobo Git Server Login Panel -...

GO-2026-5116 Build breakout using malicious Containerfile or Git HTTP server in github.com/containers/buildah

Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...

PT-2026-65349

Buildah allows a build-time breakout when using a malicious Containerfile or a malicious Git HTTP server. A crafted Git URL or Containerfile can cause Buildah to access files outside of the build context during an ADD or COPY operation...

Linux Distros Unpatched Vulnerability : CVE-2026-56623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implement...

CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

EUVD-2026-46104

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...