JE
Vendor
jelmer
10
CVEs
0
On KEV
5
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114098 | DU dulwich jelmer | 7.8 | Oct 21 | Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks |
| CVE-2026-114097 | DU dulwich jelmer | 7.8 | Oct 21 | Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter |
| CVE-2026-114096 | DU dulwich jelmer | 7.8 | Oct 21 | Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths |
| CVE-2026-114095 | DU dulwich jelmer | 6.5 | Oct 21 | Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object |
| CVE-2026-114094 | DU dulwich jelmer | 8.8 | Oct 21 | Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths |
| CVE-2026-52726 | DU dulwich jelmer | 7.5 | Jun 10 | Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload |
| CVE-2026-47734 | DU dulwich jelmer | 5.7 | Jun 10 | Dulwich has unbounded memory allocation in receive-pack from crafted thin packs |
| CVE-2026-47712 | DU dulwich jelmer | 3.3 | Jun 10 | Dulwich doesn't sanitize commit subjects in `porcelain.format_patch` |
| CVE-2026-42305 | DU dulwich jelmer | 8.8 | Jun 10 | Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows |
| CVE-2026-42563 | DU dulwich jelmer | 7.7 | Jun 10 | Dulwich Vulnerable to Command Injection via Merge Driver Path |