CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (Oct 26, 2026, 6:40 AM ET )
This week: 4,033 CVEs published, 328 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 4,033 Show in the list Critical, last 7 days 328 Show in the list Healthcare-tagged, last 7 days 8 Show in the list Known exploited (CISA KEV) 1,756 Show in the list Showing CVEs that name the product gitpython_developers:gitpython . Show all products
39 CVEs, showing 1 to 39
CVE Severity Title Published CVE-2026-114145 High 7.5 GitPython validates a submodule's ".git" path only after cloning into it (RCE) Assigned by GitHub_M
Oct 21, 2026 CVE-2026-110860 Medium 6.1 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move() Assigned by VulnCheck
Oct 14, 2026 CVE-2026-110859 High 7.5 GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name Assigned by VulnCheck
Oct 14, 2026 CVE-2026-110858 High 8.1 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec Assigned by VulnCheck
Oct 14, 2026 CVE-2026-110857 High 7.5 GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs Assigned by VulnCheck
Oct 14, 2026 CVE-2026-110856 High 7.5 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date Assigned by VulnCheck
Oct 14, 2026 CVE-2026-110855 Medium 6.5 GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name Assigned by VulnCheck
Oct 14, 2026 CVE-2026-100689 Medium 5.9 GitPython before 3.1.62 Path Traversal via gitmodules path Assigned by VulnCheck
Sep 26, 2026 CVE-2026-87819 High 7.5 GitPython before 3.1.60 Denial of Service via ReDoS Assigned by VulnCheck
Sep 9, 2026 CVE-2026-87818 Medium 6.5 GitPython 3.1.59 Local File Content Oracle via --no-index Assigned by VulnCheck
Sep 9, 2026 CVE-2026-87817 High 8.8 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation Assigned by VulnCheck
Sep 9, 2026 CVE-2026-78679 Medium 6.5 GitPython before 3.1.59 Arbitrary File Read via TagReference.create Assigned by VulnCheck
Aug 24, 2026 CVE-2026-78678 Medium 6.5 GitPython before 3.1.59 Arbitrary File Read via Repo.blame() Assigned by VulnCheck
Aug 24, 2026 CVE-2026-78677 High 7.5 GitPython before 3.1.59 Path Traversal via separate-git-dir Assigned by VulnCheck
Aug 24, 2026 CVE-2026-78676 Critical 9.8 GitPython before 3.1.59 Remote Code Execution via Config Injection Assigned by VulnCheck
Aug 24, 2026 CVE-2026-78675 High 8.4 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules Assigned by VulnCheck
Aug 24, 2026 CVE-2026-76222 High 8.2 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name Assigned by VulnCheck
Aug 19, 2026 CVE-2026-76221 High 8.8 GitPython before 3.1.58 Config Injection via option-name Assigned by VulnCheck
Aug 19, 2026 CVE-2026-76220 High 8.8 GitPython before 3.1.58 Command Execution via split_single_char_options Assigned by VulnCheck
Aug 19, 2026 CVE-2026-76219 High 8.1 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree Assigned by VulnCheck
Aug 19, 2026 CVE-2026-76218 High 7.5 GitPython before 3.1.58 Remote Code Execution via Repo.init Assigned by VulnCheck
Aug 19, 2026 CVE-2026-76217 Medium 6.5 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file Assigned by VulnCheck
Aug 19, 2026 CVE-2026-73625 High 8.8 GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73624 High 8.1 GitPython before 3.1.54 Arbitrary File Overwrite via diff Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73623 High 7.5 GitPython before 3.1.54 Remote Code Execution via --template Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73622 High 7.5 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73621 Medium 5.4 GitPython before 3.1.56 Arbitrary File Truncation via Commit.count Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73620 High 8.1 GitPython before 3.1.57 Arbitrary File Overwrite and Read Assigned by VulnCheck
Aug 13, 2026 CVE-2026-73619 Medium 6.5 GitPython before 3.1.57 Arbitrary File Read via Repo.archive() Assigned by VulnCheck
Aug 13, 2026 CVE-2026-69097 High 7.0 GitPython before 3.1.53 Config Injection via Submodule Names Assigned by VulnCheck
Aug 3, 2026 CVE-2026-67326 High 7.0 GitPython before 3.1.50 Newline Injection via config_writer section Assigned by VulnCheck
Aug 1, 2026 CVE-2026-67324 Critical 9.8 GitPython 3.1.50 Authentication Bypass via Joined Short Options Assigned by VulnCheck
Aug 1, 2026 CVE-2026-67323 High 8.4 GitPython before 3.1.51 Command Injection via unguarded Git options Assigned by VulnCheck
Aug 1, 2026 CVE-2026-67322 High 7.5 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from Assigned by VulnCheck
Aug 1, 2026 CVE-2026-67325 High 8.8 GitPython before 3.1.51 Command Injection via option prefix abbreviation Assigned by VulnCheck
Aug 1, 2026 CVE-2026-44243 High 7.8 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository Assigned by GitHub_M
May 7, 2026 CVE-2026-44244 High 7.8 GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath Assigned by GitHub_M
May 7, 2026 CVE-2026-42284 High 8.1 GitPython: Unsafe option check validates multi_options before shlex.split transforms it Assigned by GitHub_M
May 7, 2026 CVE-2026-42215 High 8.8 GitPython: Command injection via Git options bypass Assigned by GitHub_M
May 7, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosecsignals.com. Every record links back to the agency that published it.
