Skip to content

Git · weakness class

Memory Corruption

8 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
2

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

  1. gitattributes parsing integer overflow in gitCVE-2022-23521git · CVSS 9.8 · 56% likely

    CWE-190

  2. Integer overflow in `git archive`, `git log --format` leading to RCE in gitCVE-2022-41903git · CVSS 9.8 · 44% likely

    CWE-190

  3. Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length…CVE-2008-3546Git · 4.3% likely

    CWE-119

  4. Git vulnerable to Remote Code Execution via Heap overflow in `git shell`CVE-2022-39260git · CVSS 8.5 · 4.0% likely

    CWE-122

  5. Git allows a buffer overflow in 'wincred' credential helperCVE-2025-48386git · CVSS 6.3 · 0.4% likely

    CWE-120

  6. Heap-based Buffer Overflow in GitCVE-2026-105437Git · CVSS 7.5 · 0.4% likelycovered by CyberSIXT

    CWE-1223 articles3 articles this week: Git fixes six flaws enabling code execution in recursive clones

  7. Out-of-bounds Read in GitCVE-2026-114469Git · CVSS 4.4 · 0.2% likelycovered by CyberSIXT

    CWE-1252 articles2 articles this week: Git fixes six flaws enabling code execution in recursive clones

  8. Out-of-bounds Write in GitCVE-2026-114467Git · CVSS 3.3 · 0.2% likelycovered by CyberSIXT

    CWE-7872 articles2 articles this week: Git fixes six flaws enabling code execution in recursive clones

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.