{"items":[{"id":"CVE-2026-110859","published":"2026-10-14T22:52:43.585Z","updated":"2026-10-15T15:40:26.986Z","title":"GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2026-110858","published":"2026-10-14T22:52:42.217Z","updated":"2026-10-16T17:14:41.140Z","title":"GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec","severity":"CRITICAL","score":9.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-87818","published":"2026-09-09T11:21:04.681Z","updated":"2026-10-08T15:25:57.055Z","title":"GitPython 3.1.59 Local File Content Oracle via --no-index","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-78678","published":"2026-08-25T01:30:35.582Z","updated":"2026-10-08T15:25:09.232Z","title":"GitPython before 3.1.59 Arbitrary File Read via Repo.blame()","severity":"HIGH","score":7.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00412,"kevAdded":null},{"id":"CVE-2026-78676","published":"2026-08-25T01:30:33.754Z","updated":"2026-10-08T15:25:07.826Z","title":"GitPython before 3.1.59 Remote Code Execution via Config Injection","severity":"CRITICAL","score":9.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00556,"kevAdded":null},{"id":"CVE-2026-76220","published":"2026-08-19T14:02:04.108Z","updated":"2026-10-08T15:25:01.788Z","title":"GitPython before 3.1.58 Command Execution via split_single_char_options","severity":"HIGH","score":8.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0059,"kevAdded":null},{"id":"CVE-2026-76219","published":"2026-08-19T14:02:03.425Z","updated":"2026-10-08T15:25:01.192Z","title":"GitPython before 3.1.58 Arbitrary File Overwrite via read-tree","severity":"HIGH","score":7.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00543,"kevAdded":null},{"id":"CVE-2026-76218","published":"2026-08-19T14:02:02.729Z","updated":"2026-10-08T15:25:00.661Z","title":"GitPython before 3.1.58 Remote Code Execution via Repo.init","severity":"HIGH","score":7.7,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0072,"kevAdded":null},{"id":"CVE-2026-73624","published":"2026-08-13T11:28:24.155Z","updated":"2026-10-08T15:24:44.790Z","title":"GitPython before 3.1.54 Arbitrary File Overwrite via diff","severity":"HIGH","score":7.2,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00553,"kevAdded":null},{"id":"CVE-2026-73621","published":"2026-08-13T11:28:22.108Z","updated":"2026-10-08T15:24:41.812Z","title":"GitPython before 3.1.56 Arbitrary File Truncation via Commit.count","severity":"MEDIUM","score":5.3,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.0036,"kevAdded":null},{"id":"CVE-2026-42284","published":"2026-05-07T18:19:20.129Z","updated":"2026-05-09T03:56:02.927Z","title":"GitPython: Unsafe option check validates multi_options before shlex.split transforms it","severity":"HIGH","score":8.1,"vendor":"gitpython-developers","product":"GitPython","kev":false,"epss":0.00571,"kevAdded":null}]}