Git vendor intelligence
Git Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Git products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 19
- Known exploited vulnerabilities affecting Git products
- In CISA KEV
- 7
- Records also listed in the official catalog
- Beyond CISA KEV
- 12
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 6
- Git KEVs with sensor-observed exploitation activity
The catalog gap matters for Git exposure
Twelve of the nineteen exploited Git vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss 63% of this vendor portfolio.
- 37%
- Covered by CISA
- 63%
- Beyond CISA
- 10
- Product families
Attested Git vulnerabilities
19 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default |
Gitea Open Source Git Server | Confirmed | Beyond CISA | 20 Oct 2026 |
|
CVE-2026-59774
Gitea Org-mode file disclosure and code execution |
Gitea | Confirmed | Beyond CISA | 15 Oct 2026 |
|
CVE-2026-85706
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab |
GitLab | Confirmed | In CISA | 11 Sep 2026 |
|
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. |
Gitea | Confirmed | In CISA | 25 Aug 2026 |
|
CVE-2026-19478
Improper Control of Generation of Code ('Code Injection') in GitLab |
GitLab | Confirmed | Beyond CISA | 21 Aug 2026 |
|
CVE-2023-2825
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal... |
GitLab | Confirmed | Beyond CISA | 03 Aug 2026 |
|
CVE-2023-26802
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass... |
DCBI-Netlog-LAB | High | Beyond CISA | 07 Jul 2025 |
|
CVE-2023-23489
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's'... |
WordPress Plugin | High | Beyond CISA | 07 Jul 2025 |
|
CVE-2016-10108
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified... |
MyCloud NAS | High | Beyond CISA | 05 Jul 2025 |
|
CVE-2021-22175
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions... |
GitLab | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2021-39935
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before... |
GitLab | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2025-48384
Git allows arbitrary code execution through broken config quoting |
git | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2018-25126
TVT NVMS-9000 Hard-coded API Credentials & Command Injection |
NVMS-9000 | High | Beyond CISA | 24 Nov 2025 |
|
CVE-2021-4191
An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances with... |
GitLab | High | Beyond CISA | 28 Apr 2025 |
|
CVE-2021-22205
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were... |
GitLab | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2023-7028
Weak Password Recovery Mechanism for Forgotten Password in GitLab |
GitLab | Confirmed | In CISA | 01 May 2024 |
|
CVE-2022-34538
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component... |
DW MEGApix IP cameras | High | Beyond CISA | 19 Jul 2022 |
|
CVE-2021-22214
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions... |
GitLab | High | Beyond CISA | 08 Jun 2021 |
|
CVE-2017-17560
An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices. The web administration component,... |
MyCloud PR4100 | High | Beyond CISA | 12 Dec 2017 |
No Git vulnerabilities match this search or filter.
Showing 19 of 19 on this page (19 Git known exploited vulnerabilities).
Recurring weakness patterns
Limitation, control, and server-side request forgery (ssrf) account for ten mapped occurrences across this Git KEV portfolio.
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-918
Server-Side Request Forgery (SSRF)
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-59
Improper Link Resolution Before File Access ('Link Following')
CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-798
Use of Hard-coded Credentials