Vendor

    Charm

    9 known vulnerabilities in products by Charm, 0 of them actively exploited (CISA KEV).

    Key figures

    9

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    5

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Charm
    CriticalCVE-2026-24058

    Soft Serve has Critical Authentication Bypass

    also in 2 other products

    		9.8
    HighCVE-2023-43809

    Charmbracelet Soft-serve: Improper Authentication

    also in 2 other products

    		7.5
    CriticalCVE-2026-41589

    Wish has SCP Path Traversal that allows arbitrary file read/write

    also in 2 other products

    		9.6
    HighCVE-2025-22130

    Soft Serve allows path traversal attacks

    also in 2 other products

    		8.8
    CriticalCVE-2026-30832

    Soft Serve: SSRF via unvalidated LFS endpoint in repo import

    also in 2 other products

    		9.1
    CriticalCVE-2025-64522

    Soft Serve is vulnerable to SSRF through its Webhooks

    also in 2 other products

    		9.1
    HighCVE-2026-33353

    Soft Serve: Authenticated repo import can clone server-local private repositories

    also in 2 other products

    		6.5
    CriticalCVE-2022-29180

    Charm vulnerable to server-side request forgery (SSRF)

    also in 2 other products

    		5.9
    MediumCVE-2026-22253

    Soft Serve is missing an authorization check in LFS lock deletion

    also in 2 other products

    		5.4

    News

    Products

    Products by Charm
    Charm Soft Serve70