EUVD-2026-93912

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430

The Gitea platform is vulnerable to a Server-Side Request Forgery (SSRF) and forced write vulnerability due to insufficient validation of push mirror remote addresses. The system only validates these addresses against [migrations] allow and block lists during the initial mirror creation. Because ...

CVE-2017-1000117

El que levanta un servidor con CVE-2017-1000117 ¡Ejecuta el siguiente comando, abre el navegador web y accede a http://localhost:8088! $ git clone --recursive https://github.com/0gawa/CVE-2017-1000117 Hello World Si se muestra, ¡actualiza git! Es vulnerable...

cve-2025-48384-poc

PoC para CVE-2025-48384 Esta prueba de concepto demuestra la vulnerabilidad de análisis incorrecto de submódulos con rutas CR retorno de carro de Git, lo que lleva a la ejecución arbitraria de hooks durante git clone --recurse-submodules. ⚠️ Advertencia Esto es solo para fines educativos y de...

CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CVE-2026-106219

JetBrains TeamCity versions prior to 2026.2.1 are vulnerable to an information disclosure issue due to insufficient validation of Git submodule URLs . This flaw allows an attacker to perform unauthorized reading of local repositories hosted on the server. To remediate this vulnerability, users sh...

EUVD-2026-93505

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CVE-2026-106219

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server...

CLSA-2026-1791293888 TuxCare security update for simple-git (2 CVEs)

TuxCare rebuilt simple-git to address 2 CVEs. Fixed in 3.36.0-tuxcare.1...

CVE-2026-40579

Referencias https://github.com/steveukx/git-js/security/advisories/GHSA-mr9g-9pv2-x45j https://vulners.com/cve/CVE-2026-40579...

CVE-2026-44881_exploit

CVE-2026-44881 — Enlace simbólico Git de Portainer → Lectura arbitraria de archivos del host Exploit de un solo script para CVE-2026-44881 , una inyección de enlace simbólico Git en el flujo de despliegue de stacks de Portainer que permite a cualquier usuario autenticado con privilegios bajos y...

prefect-cve-2026-5366

PoC: CVE-2026-5366 - Inyección de argumentos de Git en Prefect GitRepository Vulnerabilidad: inyección de argumentos de git que conduce a RCE a través de commitsha además de inyección de argumentos a través de directories Versión: vulnerable en 3.6.23, corregida en 3.6.25+ Archivo:...

Path Traversal

Apache MINA SSHD is vulnerable to path traversal. The vulnerability is due to insufficient path validation on Windows, where the sshd-git component fails to properly restrict file system paths and an authenticated remote user can craft directory traversal sequences to access git repositories...

guardskill

GuardSkill A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do. npx guardskill . Read-only. No network calls, no telemetry, no configuration, no account, no dependencies. It reads git configuration and hook scripts, prints what...

cve-2022-36804

Atlassian Bitbucket RCE PoC - CVE-2022-36804 Este repositorio contiene un script PoC simple para la vulnerabilidad de ejecución remota de código de Atlassian Bitbucket. Puedes ejecutar este script simplemente con los siguientes comandos: echo 'bitbucket.redacted.com' | python3 cve-2022-36804.py O...

CVE-2026-60004-PoC

CVE-2026-60004: Ejecución remota de código en la API Diffpatch de Gitea !WARNING Este repositorio está destinado exclusivamente a la investigación de seguridad autorizada y a pruebas de laboratorio controladas. No ejecute la prueba de concepto contra sistemas que no posea o para los que no tenga...

[SECURITY] Fedora 45 Update: ocaml-patch-3.1.2-3.fc45

The patch module lets you apply your unified diffs in pure OCaml. The loosely specified diff file format is widely used for transmitting differences of line-based information. The motivating example is opam, which is able to validate updates being cryptographically signed by providing a unified...