https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 09 Aug 2026 22:10:19 +0000 https://vulnerability.circl.lu/sighting/17b8be92-a4f9-4f16-83d7-a40a51626db8/export {"uuid": "17b8be92-a4f9-4f16-83d7-a40a51626db8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97106", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-71557-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 01:52:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-09T00:53:16.564376Z"} {"uuid": "17b8be92-a4f9-4f16-83d7-a40a51626db8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97106", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-71557-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 01:52:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-09T00:53:16.564376Z"} https://vulnerability.circl.lu/sighting/17b8be92-a4f9-4f16-83d7-a40a51626db8/export Sun, 09 Aug 2026 00:53:16 +0000 https://vulnerability.circl.lu/sighting/106221a7-e1a7-4548-b86b-c8ca4800df8f/export {"uuid": "106221a7-e1a7-4548-b86b-c8ca4800df8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "published-proof-of-concept", "source": "Telegram/HtR3voKuUb4Szlun3fBzuT2ivqN8DL7Kwlo1E3tEtAzGF3w", "content": "", "creation_timestamp": "2026-08-09T00:29:23.938394Z"} {"uuid": "106221a7-e1a7-4548-b86b-c8ca4800df8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "published-proof-of-concept", "source": "Telegram/HtR3voKuUb4Szlun3fBzuT2ivqN8DL7Kwlo1E3tEtAzGF3w", "content": "", "creation_timestamp": "2026-08-09T00:29:23.938394Z"} https://vulnerability.circl.lu/sighting/106221a7-e1a7-4548-b86b-c8ca4800df8f/export Sun, 09 Aug 2026 00:29:23 +0000 https://vulnerability.circl.lu/sighting/20a17efb-d9da-4f45-84e9-a7c9d46ecc7e/export {"uuid": "20a17efb-d9da-4f45-84e9-a7c9d46ecc7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "seen", "source": "https://gist.github.com/alon710/71d0ff9c71dc1f5ee8e40bba3da46014", "content": "# CVE-2026-71557: CVE-2026-71557: Path Traversal and Configuration Overwrite in go-git Filesystem Storage Engine\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71557\n\n## Summary\nCVE-2026-71557 is a path traversal vulnerability in go-git, a pure-Go implementation of Git. In vulnerable versions, the filesystem-backed storage engine fails to validate reference names before mapping them to on-disk paths. An attacker hosting a malicious Git server can advertise references containing directory traversal sequences, such as 'refs/heads/../../config', to write or overwrite files outside the intended reference storage directory.\n\n## TL;DR\nA path traversal flaw in go-git's reference processing allows a malicious remote server to overwrite local repository configuration files (such as .git/config) during clone or fetch operations, potentially leading to arbitrary command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.3 (Medium)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **Impact**: High Integrity (I:H), Low Availability (A:L), Remote Code Execution (RCE)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing github.com/go-git/go-git/v5 prior to v5.19.2 with filesystem-backed storage engines\n- Applications utilizing github.com/go-git/go-git/v6 from v6.0.0-alpha.1 to v6.0.0-alpha.4 with filesystem-backed storage engines\n\n## Mitigation\n\n- Upgrade the go-git library to the latest safe release branch.\n- Migrate the repository storage implementation from filesystem-backed storage to in-memory storage.\n- Enforce network perimeter access controls to prevent interactions with untrusted or public third-party Git hosting platforms.\n\n**Remediation Steps:**\n1. Update your Go project dependencies to pull go-git v5.19.2 or v6.0.0-alpha.5.\n2. Verify the dependency resolution change in the go.mod and go.sum files.\n3. Audit internal tools that perform clone or fetch operations, modifying the configuration to leverage storage/memory where appropriate.\n\n## References\n\n- [GitHub Security Advisory GHSA-qgq7-7hm3-q39j](https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j)\n- [Public Proof of Concept Repository](https://github.com/Saku0512/CVE-2026-71557-poc)\n- [go-git Pull Request #2247](https://github.com/go-git/go-git/pull/2247)\n- [go-git Pull Request #2254](https://github.com/go-git/go-git/pull/2254)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71557) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T10:39:06.928392Z"} {"uuid": "20a17efb-d9da-4f45-84e9-a7c9d46ecc7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "seen", "source": "https://gist.github.com/alon710/71d0ff9c71dc1f5ee8e40bba3da46014", "content": "# CVE-2026-71557: CVE-2026-71557: Path Traversal and Configuration Overwrite in go-git Filesystem Storage Engine\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71557\n\n## Summary\nCVE-2026-71557 is a path traversal vulnerability in go-git, a pure-Go implementation of Git. In vulnerable versions, the filesystem-backed storage engine fails to validate reference names before mapping them to on-disk paths. An attacker hosting a malicious Git server can advertise references containing directory traversal sequences, such as 'refs/heads/../../config', to write or overwrite files outside the intended reference storage directory.\n\n## TL;DR\nA path traversal flaw in go-git's reference processing allows a malicious remote server to overwrite local repository configuration files (such as .git/config) during clone or fetch operations, potentially leading to arbitrary command execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.3 (Medium)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **Impact**: High Integrity (I:H), Low Availability (A:L), Remote Code Execution (RCE)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing github.com/go-git/go-git/v5 prior to v5.19.2 with filesystem-backed storage engines\n- Applications utilizing github.com/go-git/go-git/v6 from v6.0.0-alpha.1 to v6.0.0-alpha.4 with filesystem-backed storage engines\n\n## Mitigation\n\n- Upgrade the go-git library to the latest safe release branch.\n- Migrate the repository storage implementation from filesystem-backed storage to in-memory storage.\n- Enforce network perimeter access controls to prevent interactions with untrusted or public third-party Git hosting platforms.\n\n**Remediation Steps:**\n1. Update your Go project dependencies to pull go-git v5.19.2 or v6.0.0-alpha.5.\n2. Verify the dependency resolution change in the go.mod and go.sum files.\n3. Audit internal tools that perform clone or fetch operations, modifying the configuration to leverage storage/memory where appropriate.\n\n## References\n\n- [GitHub Security Advisory GHSA-qgq7-7hm3-q39j](https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j)\n- [Public Proof of Concept Repository](https://github.com/Saku0512/CVE-2026-71557-poc)\n- [go-git Pull Request #2247](https://github.com/go-git/go-git/pull/2247)\n- [go-git Pull Request #2254](https://github.com/go-git/go-git/pull/2254)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71557) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T10:39:06.928392Z"} https://vulnerability.circl.lu/sighting/20a17efb-d9da-4f45-84e9-a7c9d46ecc7e/export Sat, 08 Aug 2026 10:39:06 +0000 https://vulnerability.circl.lu/sighting/7ec4df2d-c78c-47ba-b9cb-9fa7d9b88a1d/export {"uuid": "7ec4df2d-c78c-47ba-b9cb-9fa7d9b88a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97106", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-71557-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 01:52:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T03:02:14.418651Z"} {"uuid": "7ec4df2d-c78c-47ba-b9cb-9fa7d9b88a1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71557", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97106", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-71557-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Saku0512\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-08 01:52:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T03:02:14.418651Z"} https://vulnerability.circl.lu/sighting/7ec4df2d-c78c-47ba-b9cb-9fa7d9b88a1d/export Sat, 08 Aug 2026 03:02:14 +0000