{"items":[{"id":"CVE-2025-48384","published":"2025-07-08T18:23:48.710Z","updated":"2026-02-26T17:51:05.174Z","title":"Git allows arbitrary code execution through broken config quoting","severity":"HIGH","score":8.1,"vendor":"git","product":"git","kev":true,"epss":0.04379,"kevAdded":"2025-08-25","exploit":true},{"id":"CVE-2025-48385","published":"2025-07-08T18:23:44.405Z","updated":"2025-11-04T21:11:01.641Z","title":"Git alllows arbitrary file writes via bundle-uri parameter injection","severity":"HIGH","score":8.6,"vendor":"git","product":"git","kev":false,"epss":0.0106,"kevAdded":null,"exploit":false},{"id":"CVE-2025-48386","published":"2025-07-08T18:23:41.246Z","updated":"2025-11-04T21:11:02.964Z","title":"Git allows a buffer overflow in 'wincred' credential helper","severity":"MEDIUM","score":6.3,"vendor":"git","product":"git","kev":false,"epss":0.00431,"kevAdded":null,"exploit":false},{"id":"CVE-2024-52005","published":"2025-01-15T17:35:02.379Z","updated":"2025-01-15T20:10:36.473Z","title":"The sideband payload is passed unfiltered to the terminal in git","severity":"HIGH","score":7.5,"vendor":"git","product":"git","kev":false,"epss":0.00509,"kevAdded":null,"exploit":false},{"id":"CVE-2024-50349","published":"2025-01-14T18:43:42.620Z","updated":"2025-11-03T20:45:13.649Z","title":"Git does not sanitize URLs when asking for credentials interactively","severity":"LOW","score":2.1,"vendor":"git","product":"git","kev":false,"epss":0.00653,"kevAdded":null,"exploit":false},{"id":"CVE-2024-52006","published":"2025-01-14T18:39:52.748Z","updated":"2025-11-03T20:45:24.231Z","title":"Newline confusion in credential helpers can lead to credential exfiltration in git","severity":"LOW","score":2.1,"vendor":"git","product":"git","kev":false,"epss":0.01035,"kevAdded":null,"exploit":false},{"id":"CVE-2024-32465","published":"2024-05-14T19:18:33.914Z","updated":"2025-11-04T16:12:12.576Z","title":"Git's protections for cloning untrusted repositories can be bypassed","severity":"HIGH","score":7.4,"vendor":"git","product":"git","kev":false,"epss":0.01026,"kevAdded":null,"exploit":false},{"id":"CVE-2024-32021","published":"2024-05-14T19:15:28.534Z","updated":"2025-11-04T16:12:11.603Z","title":"Local Git clone may hardlink arbitrary user-readable files into the new repository's \"objects/\" directory","severity":"LOW","score":3.9,"vendor":"git","product":"git","kev":false,"epss":0.01023,"kevAdded":null,"exploit":true},{"id":"CVE-2024-32020","published":"2024-05-14T18:54:08.184Z","updated":"2025-02-13T17:52:05.240Z","title":"Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will","severity":"LOW","score":3.9,"vendor":"git","product":"git","kev":false,"epss":0.00519,"kevAdded":null,"exploit":false},{"id":"CVE-2024-32004","published":"2024-05-14T18:46:32.192Z","updated":"2025-11-04T16:12:10.670Z","title":"Git vulnerable to Remote Code Execution while cloning special-crafted local repositories","severity":"HIGH","score":8.2,"vendor":"git","product":"git","kev":false,"epss":0.01351,"kevAdded":null,"exploit":false},{"id":"CVE-2024-32002","published":"2024-05-14T18:40:46.652Z","updated":"2025-11-04T16:12:09.634Z","title":"Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution","severity":"CRITICAL","score":9.1,"vendor":"git","product":"git","kev":false,"epss":0.29234,"kevAdded":null,"exploit":true},{"id":"CVE-2023-29007","published":"2023-04-25T20:09:52.182Z","updated":"2026-11-02T22:32:48.199Z","title":"Arbitrary configuration injection via `git submodule deinit`","severity":"HIGH","score":7,"vendor":"git","product":"git","kev":false,"epss":0.05609,"kevAdded":null,"exploit":false},{"id":"CVE-2023-25652","published":"2023-04-25T19:17:35.315Z","updated":"2025-11-04T16:09:58.740Z","title":"\"git apply --reject\" partially-controlled arbitrary file write","severity":"HIGH","score":7.5,"vendor":"git","product":"git","kev":false,"epss":0.51883,"kevAdded":null,"exploit":false},{"id":"CVE-2023-23946","published":"2023-02-14T19:48:00.554Z","updated":"2026-10-08T21:14:08.741Z","title":"Git's `git apply` overwriting paths outside the working tree","severity":"MEDIUM","score":6.2,"vendor":"git","product":"git","kev":false,"epss":0.01135,"kevAdded":null,"exploit":false},{"id":"CVE-2023-22490","published":"2023-02-14T19:47:56.863Z","updated":"2026-10-08T21:14:06.502Z","title":"Git vulnerable to local clone-based data exfiltration with non-local transports","severity":"MEDIUM","score":5.5,"vendor":"git","product":"git","kev":false,"epss":0.0071,"kevAdded":null,"exploit":false},{"id":"CVE-2022-23521","published":"2023-01-17T22:17:17.765Z","updated":"2025-02-13T16:32:19.291Z","title":"gitattributes parsing integer overflow in git","severity":"CRITICAL","score":9.8,"vendor":"git","product":"git","kev":false,"epss":0.56334,"kevAdded":null,"exploit":false},{"id":"CVE-2022-41903","published":"2023-01-17T22:17:16.123Z","updated":"2025-03-10T21:21:50.039Z","title":"Integer overflow in `git archive`, `git log --format` leading to RCE in git","severity":"CRITICAL","score":9.8,"vendor":"git","product":"git","kev":false,"epss":0.44268,"kevAdded":null,"exploit":false},{"id":"CVE-2022-39260","published":"2022-10-19T00:00:00.000Z","updated":"2024-08-03T12:00:43.573Z","title":"Git vulnerable to Remote Code Execution via Heap overflow in `git shell`","severity":"HIGH","score":8.5,"vendor":"git","product":"git","kev":false,"epss":0.03987,"kevAdded":null,"exploit":false},{"id":"CVE-2022-39253","published":"2022-10-19T00:00:00.000Z","updated":"2024-08-03T12:00:43.267Z","title":"Git subject to exposure of sensitive information via local clone of symbolic links","severity":"MEDIUM","score":5.5,"vendor":"git","product":"git","kev":false,"epss":0.01481,"kevAdded":null,"exploit":false},{"id":"CVE-2022-29187","published":"2022-07-12T00:00:00.000Z","updated":"2024-08-03T06:17:54.233Z","title":"Bypass of safe.directory protections in Git","severity":"HIGH","score":7.8,"vendor":"git","product":"git","kev":false,"epss":0.00446,"kevAdded":null,"exploit":false},{"id":"CVE-2021-21300","published":"2021-03-09T00:00:00.000Z","updated":"2024-08-03T18:09:15.850Z","title":"malicious repositories can execute remote code while cloning","severity":"HIGH","score":8,"vendor":"git","product":"git","kev":false,"epss":0.88533,"kevAdded":null,"exploit":true},{"id":"CVE-2020-11008","published":"2020-04-21T18:40:13.000Z","updated":"2024-08-04T11:21:14.528Z","title":"Malicious URLs can still cause Git to send a stored credential to the wrong server","severity":"MEDIUM","score":4,"vendor":"git","product":"git","kev":false,"epss":0.03867,"kevAdded":null,"exploit":false},{"id":"CVE-2020-5260","published":"2020-04-14T22:50:12.000Z","updated":"2024-08-04T08:22:09.095Z","title":"malicious URLs may cause Git to present stored credentials to the wrong server","severity":"CRITICAL","score":9.3,"vendor":"git","product":"git","kev":false,"epss":0.14887,"kevAdded":null,"exploit":false}]}