Git For Windows Project · product
git
14 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.
- Git clone remote code execution vulnerability in git-for-windows
- In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
- Uncontrolled search for the Git directory in Git for Windows
- Git looks for localized messages in the wrong place
- Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
- Git for Windows' installer can be tricked into executing an untrusted binary
- gitk can inadvertently call executables in the worktree
- Git for Windows's config file of `connect.exe` is susceptible to malicious placing
- Git CMD erroneously executes `doskey.exe` in the current directory, if it exists
- Git for Windows' installer is susceptible to DLL side loading attacks
- Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers
- Git for Windows leaks NTLM hash when cloning from an attacker-controlled server
- Git for Windows: git-credential-wincred Erase Path Heap Overflow
- Git for Windows: git-credential-wincred OAuth Store Heap Overflow
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP