Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Sep 14, 2026Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories CVE-2026-91773 · Other software · charmbracelet · reported by VulnCheckMedium 5.3
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2026Soft Serve is a self-hostable Git server for the command line.CVE-2026-33353 · Other software · charmbracelet · reported by GitHubHigh 7.1
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This issue has been patched in version 0.11.6.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2026Soft Serve is a self-hostable Git server for the command line.CVE-2026-30832 · Other software · charmbracelet · reported by GitHubCritical 9.1
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Soft Serve is a self-hostable Git server for the command line.CVE-2026-24058 · Other software · charmbracelet · reported by GitHubHigh 8.1
Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2026Soft Serve is a self-hostable Git server for the command line.CVE-2026-22253 · Other software · charmbracelet · reported by GitHubMedium 5.4
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion endpoint allows any authenticated user with repository write access to delete locks owned by other users by setting the force flag. The vulnerable code path processes force deletions before retrieving user context, bypassing ownership validation entirely. This issue has been patched in version 0.11.2.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Soft Serve is a self-hostable Git server for the command line.CVE-2025-64522 · Other software · charmbracelet · reported by GitHubCritical 9.1
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025Soft Serve is a self-hostable Git server for the command line.CVE-2025-64494 · Other software · charmbracelet · reported by GitHubMedium 4.6
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. This issue is fixed in version 0.10.0.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Soft Serve is a self-hostable Git server for the command line.CVE-2025-58355 · Other software · charmbracelet · reported by GitHubHigh 7.7
Soft Serve is a self-hostable Git server for the command line. In versions 0.9.1 and below, attackers can create or override arbitrary files with uncontrolled data through its SSH API. This issue is fixed in version 0.10.0.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025Soft Serve is a self-hostable Git server for the command line.CVE-2025-22130 · Other software · charmbracelet · reported by GitHubMedium 5.3
Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing non-admin users to access and take over other user's repositories. A malicious user then can modify, delete, and arbitrarily repositories as if they were an admin user without explicitly giving them permissions. This is patched in v0.8.2.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Soft Serve is a self-hostable Git server for the command line.CVE-2024-41956 · Other software · charmbracelet · reported by GitHubHigh 8.1
Soft Serve is a self-hostable Git server for the command line. Prior to 0.7.5, it is possible for a user who can commit files to a repository hosted by Soft Serve to execute arbitrary code via environment manipulation and Git. The issue is that Soft Serve passes all environment variables given by the client to git subprocesses. This includes environment variables that control program execution, such as LD_PRELOAD. This vulnerability is fixed in 0.7.5.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2023Soft Serve is a self-hostable Git server for the command line.CVE-2023-43809 · Other software · charmbracelet · reported by GitHubHigh 7.5
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the `allow-keyless` setting, and the public key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validation procedures of the public key step during SSH request handshake, granting unauthorized access if the keyboard-interaction mode is utilized. An attacker could exploit this vulnerability by presenting manipulated SSH requests using keyboard-interactive authentication mode. This could potentially result in unauthorized access to the Soft Serve. Users should upgrade to the latest Soft Serve version `v0.6.2` to receive the patch for this issue. To workaround this vulnerability without upgrading, users can temporarily disable Keyboard-Interactive SSH Authentication using the `allow-keyless` setting.
- Product
- soft-serve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.