git

Every one of the 39 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Git allows arbitrary code execution through broken config quotingCVE-2025-48384git · CVSS 8.1 · 4.5% likely

   CWE-436

2. malicious repositories can execute remote code while cloningCVE-2021-21300git · CVSS 8 · 89% likely

   CWE-59

3. gitattributes parsing integer overflow in gitCVE-2022-23521git · CVSS 9.8 · 56% likely

   CWE-190

4. "git apply --reject" partially-controlled arbitrary file writeCVE-2023-25652git · CVSS 7.5 · 52% likely

   CWE-22

5. Integer overflow in `git archive`, `git log --format` leading to RCE in gitCVE-2022-41903git · CVSS 9.8 · 44% likely

   CWE-190

6. Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code ExecutionCVE-2024-32002git · CVSS 9.1 · 29% likely

   CWE-22

7. The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restr…CVE-2015-7545Git Project · 19% likely

   CWE-20

8. malicious URLs may cause Git to present stored credentials to the wrong serverCVE-2020-5260git · CVSS 9.3 · 15% likely

   CWE-20

9. The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.CVE-2008-5517Git · 12% likely

   CWE-94

10. git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized argume…CVE-2009-2108Git · 5.8% likely

    CWE-399

11. Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.CVE-2010-3906Git · 5.6% likely

    CWE-79

12. Arbitrary configuration injection via `git submodule deinit`CVE-2023-29007git · CVSS 7 · 5.6% likely

    CWE-74

13. Command InjectionCVE-2022-25648Git · CVSS 8.1 · 4.6% likely

    CWE-88

14. The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_search.CVE-2008-5516Git · 4.4% likely

    CWE-78

15. Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length…CVE-2008-3546Git · 4.3% likely

    CWE-119

16. Git vulnerable to Remote Code Execution via Heap overflow in `git shell`CVE-2022-39260git · CVSS 8.5 · 4.0% likely

    CWE-122

17. Malicious URLs can still cause Git to send a stored credential to the wrong serverCVE-2020-11008git · CVSS 4 · 3.9% likely

    CWE-20

18. Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.CVE-2006-0477Git · 3.3% likely
19. Remote Code Execution (RCE)CVE-2021-23632Git Project · CVSS 6.6 · 2.4% likely

    CWE-78

20. Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode u…CVE-2015-7082Git Project · 1.7% likely
21. Git subject to exposure of sensitive information via local clone of symbolic linksCVE-2022-39253git · CVSS 5.5 · 1.5% likely

    CWE-200

22. Git vulnerable to Remote Code Execution while cloning special-crafted local repositoriesCVE-2024-32004git · CVSS 8.2 · 1.4% likely

    CWE-114

23. Git's `git apply` overwriting paths outside the working treeCVE-2023-23946git · CVSS 6.2 · 1.1% likely

    CWE-22

24. Git alllows arbitrary file writes via bundle-uri parameter injectionCVE-2025-48385git · CVSS 8.6 · 1.1% likely

    CWE-88

25. Newline confusion in credential helpers can lead to credential exfiltration in gitCVE-2024-52006git · CVSS 2.1 · 1.0% likely

    CWE-116

26. Git's protections for cloning untrusted repositories can be bypassedCVE-2024-32465git · CVSS 7.4 · 1.0% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.