Priority MEDIUM 40
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted re…
CVSS 4.0HIGH 8.6· Network · Low privileges · No interaction · EPSS 0.0042 · Published 2026-11-06 · Fixed in 2.0.5 CWE-22
Priority LOW 24
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00342 · Published 2026-09-15 · Fixed in 0.12.0 CWE-639
Priority HIGH 76
Wish is an SSH server with defaults and a collection of middlewares.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2026-05-07 · Fixed in 2.0.1 CWE-22
Priority HIGH 70
Soft Serve is a self-hostable Git server for the command line.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00378 · Published 2026-03-24 · Fixed in 0.11.6 CWE-200
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · No interaction · EPSS 0.00365 · Published 2026-03-07 · Fixed in 0.11.4 CWE-918
Priority LOW 38
Soft Serve is a self-hostable Git server for the command line.
CVSS 4.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.00578 · Published 2026-01-22 · Fixed in 0.11.3 CWE-289
Priority MEDIUM 58
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2026-01-08 · Fixed in 0.11.2 CWE-863
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1CRITICAL 9.1· Network · Low privileges · No interaction · EPSS 0.00368 · Published 2025-11-10 · Fixed in 0.11.1 CWE-918
Priority LOW 20
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00191 · Published 2025-11-08 · Fixed in 0.11.0 CWE-150
Priority HIGH 67
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00345 · Published 2025-09-03 · Fixed in 0.10.0 CWE-22
Priority LOW 25
Soft Serve is a self-hostable Git server for the command line.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00698 · Published 2025-01-08 · Fixed in 0.8.2 CWE-22
Priority LOW 38
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00509 · Published 2024-08-01 · Fixed in 0.7.5 CWE-78
Priority HIGH 72
Soft Serve is a self-hostable Git server for the command line.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01217 · Published 2023-10-04 · Fixed in 0.6.2 CWE-287
Priority MEDIUM 43
A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00799 · Published 2022-05-07 · Fixed in 0.12.1 CWE-918
THREATIST.IORead the docs