Git
Vulnerability activity for Git: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 1
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 7.5HighNov 10, 2026Git Memory corruptionCVE-2026-105437Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. That total was kept in a 32-bit signed integer. The conflict-marker-size attribute, which can be set from a committed .gitattributes file, accepts any positive integer, and the markers are written severa
- 8.1HighJul 8, 2025Git Path traversal / file handlingCVE-2025-48384Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage return characters in configuration files.Exploited4.4% likelyExploit code
- 9.8CriticalJan 17, 2023git Memory corruptionCVE-2022-23521Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this p56% likelyExploit code
- 9.8CriticalJan 17, 2023git Memory corruptionCVE-2022-41903Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::44% likelyExploit code
Top products
- Git1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- GitLab · Nov 10, 2026GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8CVE-2026-105437
- Atlassian · Oct 20, 2026Atlassian Security Bulletin October 20, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Sep 15, 2026Atlassian Security Bulletin September 15, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Aug 18, 2026Atlassian Security Bulletin August 18, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Jul 21, 2026Atlassian Security Bulletin July 21, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Jun 16, 2026Atlassian Security Bulletin June 16, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · May 19, 2026Atlassian Security Bulletin May 19, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Apr 21, 2026Atlassian Security Bulletin April 21, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Mar 17, 2026Atlassian Security Bulletin March 17, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Feb 17, 2026Atlassian Security Bulletin February 17, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2022-41903CVE-2022-23521
- Atlassian · Dec 11, 2025Atlassian Security Bulletin December 11, 2025CVE-2022-41903CVE-2022-23521
- Atlassian · Nov 18, 2025Atlassian Security Bulletin November 18, 2025CVE-2022-41903CVE-2022-23521
- Atlassian · Oct 21, 2025Atlassian Security Bulletin October 21, 2025CVE-2022-41903CVE-2022-23521
- Atlassian · Sep 16, 2025Atlassian Security Bulletin September 16, 2025CVE-2022-41903CVE-2022-23521
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.