Vendor
Charmbracelet
13 known vulnerabilities in products by Charmbracelet, 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-24058 | Soft Serve has Critical Authentication Bypass | 9.8 | |
| High | CVE-2023-43809 | Charmbracelet Soft-serve: Improper Authentication | 7.5 | |
| Critical | CVE-2026-41589 | Wish has SCP Path Traversal that allows arbitrary file read/write | 9.6 | |
| High | CVE-2025-22130 | Soft Serve allows path traversal attacks | 8.8 | |
| Critical | CVE-2026-30832 | Soft Serve: SSRF via unvalidated LFS endpoint in repo import | 9.1 | |
| Critical | CVE-2025-64522 | Soft Serve is vulnerable to SSRF through its Webhooks | 9.1 | |
| High | CVE-2024-41956 | Soft Serve allows arbitrary code execution by crafting git-lfs requests | 8.1 | |
| Medium | CVE-2026-91773 | Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks | 4.3 | |
| High | CVE-2026-33353 | Soft Serve: Authenticated repo import can clone server-local private repositories | 6.5 | |
| Critical | CVE-2022-29180 | Charm vulnerable to server-side request forgery (SSRF) | 5.9 | |
| High | CVE-2025-58355 | Soft Serve is vulnerable to arbitrary file writing through its SSH API | 7.7 | |
| Medium | CVE-2026-22253 | Soft Serve is missing an authorization check in LFS lock deletion | 5.4 | |
| Medium | CVE-2025-64494 | Soft Serve does not sanitize ANSI escape sequences in user input | 4.6 |
News
Products
| Soft-serve | 11 | 0 |