13375 matches found
ALSA-2026:3985 Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726...
Remote Code Execution (RCE)
Overview org.webjars.npm:simple-git is an A light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Remote Code Execution RCE due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --conf...
3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +637 more potentially affected by CVE-2022-25912 +1 more via simple-git (>=3.0.3, <=3.35.2)
simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =0.0.0-aj-beta.221, =0.0.0-aj-beta.227 and more Source cves: CVE-2022-25912, CVE-2026-6951 Source advisory: SNYK:JS-SIMPLEGIT-15456078...
org.webjars.npm:g-status (2.0.2), org.webjars.npm:graphql-toolkit__git-loader (0.7.5) potentially affected by CVE-2022-25912 +1 more via org.webjars.npm:simple-git (>=1.129.0, <=1.132.0)
org.webjars.npm:simple-git MAVEN version =1.129.0, =1.132.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:simple-git and may be impacted: - org.webjars.npm:g-status 2.0.2 - org.webjars.npm:graphql-toolkitgit-loader 0.7.5 Source cves:...
Remote Code Execution (RCE)
Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Remote Code Execution RCE due to an incomplete fix for CVE-2022-25912 that blocks the -c option but not the equivalent --config form. If untrust...
CVE-2026-30832 Soft Serve: SSRF via unvalidated LFS endpoint in repo import
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is...
CVE-2026-26194
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been...
RLSA-2026:3928 Important: git-lfs security update
Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted...
git-lfs security update
An update is available for git-lfs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, videos...
RHSA-2026:3932 Red Hat Security Advisory: git-lfs security update
Bulletin has no description...
RHSA-2026:3931 Red Hat Security Advisory: git-lfs security update
Bulletin has no description...
RHSA-2026:3930 Red Hat Security Advisory: git-lfs security update
Bulletin has no description...
RHSA-2026:3929 Red Hat Security Advisory: git-lfs security update
Bulletin has no description...
RHSA-2026:3928 Red Hat Security Advisory: git-lfs security update
Bulletin has no description...
Malicious Package
Overview @mosfe/beam-git-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2026-23710
Name of the Vulnerable Software and Affected Versions Anthropic Git MCP server affected versions not specified Description The Anthropic Git MCP server contains an argument injection flaw that allows for Remote Code Execution RCE. The issue was identified in Anthropic’s own implementation of the...
PT-2026-23793
Name of the Vulnerable Software and Affected Versions Soft Serve versions 0.6.0 through 0.11.3 Description Soft Serve, a self-hostable Git server, contains a server-side request forgery SSRF issue. An authenticated SSH user can manipulate the server to make HTTP requests to internal or private IP...
RockyLinux 9 : git-lfs (RLSA-2026:3928)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:3928 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 golang: net/url: Memory exhaustion in...
RHEL 9 : git-lfs (RHSA-2026:3928)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:3928 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...
RHEL 9 : git-lfs (RHSA-2026:3930)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:3930 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...