Core tools and libraries: vulnerabilities and fixes

OpenSSL, OpenSSH, curl, Git, GnuPG, archivers and other building blocks. 141 CVEs tracked.

Core tools and libraries has 141 tracked vulnerabilities, 11 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 100. Most recent: 2026-10-23. Highest priority: CVE-2026-60004 (score 97/100).

• CVE-2026-60004 CRITICAL 9.8 EXPLOITED UPGRADE Gitea Code Injection Vulnerability
• CVE-2026-73240 CRITICAL 9.8 UPGRADE Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al
• CVE-2026-67324 CRITICAL 9.8 UPGRADE GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pa
• CVE-2026-74886 CRITICAL 9.8 UPGRADE openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuar
• CVE-2026-74880 CRITICAL 9.8 UPGRADE openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry
• CVE-2023-23919 HIGH 7.5 UPGRADE A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did d
• CVE-2023-27534 HIGH 8.8 UPGRADE MITIGATE A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be
• CVE-2023-28319 HIGH 7.5 UPGRADE UPGRADE A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH ser
• CVE-2026-67325 HIGH 8.8 UPGRADE GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's lon
• CVE-2023-27535 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can r
• CVE-2023-27536 MEDIUM 5.9 UPGRADE MITIGATE An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse p
• CVE-2023-28321 MEDIUM 5.9 UPGRADE MITIGATE An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wil
• CVE-2026-111813 CRITICAL 10.0 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert
• CVE-2022-43552 MEDIUM 5.9 UPGRADE UPGRADE A use after free vulnerability exists in curl <7.87.0
• CVE-2023-23916 MEDIUM 6.5 UPGRADE MITIGATE An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "ch
• CVE-2023-28320 MEDIUM 5.9 UPGRADE UPGRADE A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backend
• CVE-2026-67323 HIGH 8.4 UPGRADE GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archi
• CVE-2023-27537 MEDIUM 5.9 DOWNGRADE MITIGATE A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles"
• CVE-2026-17556 CRITICAL 9.1 UPGRADE A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated atta
• CVE-2026-70375 HIGH 8.8 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer compon
• CVE-2026-73625 HIGH 8.8 UPGRADE GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options gua
• CVE-2026-73294 CRITICAL 9.9 Semaphore UI is a web interface for managing DevOps tools
• CVE-2026-76221 HIGH 8.8 UPGRADE GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allow
• CVE-2026-102560 HIGH 8.6 UPGRADE MITIGATE A flaw was found in libsoup
• CVE-2026-67599 HIGH 7.2 ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticat
• CVE-2026-17510 HIGH 7.5 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a
• CVE-2026-67623 HIGH 8.8 Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arb
• CVE-2026-73622 HIGH 7.5 UPGRADE GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add()
• CVE-2026-74892 HIGH 7.5 UPGRADE openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry serve
• CVE-2026-56748 HIGH 8.8 UPGRADE Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a re
• CVE-2026-66041 HIGH 8.8 UPGRADE FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf
• CVE-2026-72538 HIGH 8.8 An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve r
• CVE-2026-73623 HIGH 7.5 UPGRADE GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, all
• CVE-2026-75913 CRITICAL 9.3 CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerabil
• CVE-2026-16492 MEDIUM 5.5 A weakness has been identified in umijs umi up to 4.6.63
• CVE-2026-64665 HIGH 8.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-64831 HIGH 8.8 UPGRADE FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware d
• CVE-2026-64834 HIGH 7.5 UPGRADE FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libav
• CVE-2026-65907 CRITICAL 9.1 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
• CVE-2026-72767 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability
• CVE-2026-73620 HIGH 8.1 UPGRADE GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create()
• CVE-2026-73624 HIGH 8.1 UPGRADE GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method
• CVE-2026-93471 HIGH 8.7 Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an u
• CVE-2023-28322 LOW 3.7 UPGRADE MITIGATE An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might err
• CVE-2026-64612 HIGH 7.5 A flaw was found in libcupsfilters and cups-filters
• CVE-2026-64830 HIGH 8.8 UPGRADE FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer
• CVE-2023-23915 MEDIUM 6.5 UPGRADE MITIGATE A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS
• CVE-2026-19266 MEDIUM 5.5 A vulnerability was determined in Kirachon context-engine up to 1.9.0
• CVE-2026-62200 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext t
• CVE-2026-67322 HIGH 7.5 UPGRADE GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()
• CVE-2024-12243 MEDIUM 5.3 A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing
• CVE-2026-53455 HIGH 8.6 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-64835 HIGH 8.8 UPGRADE FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decode
• CVE-2026-114611 CRITICAL 9.1 OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and m
• CVE-2026-106764 HIGH 7.5 An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseB
• CVE-2026-62999 HIGH 7.5 Copier is a library and CLI app for rendering project templates
• CVE-2026-75912 HIGH 7.4 CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows
• CVE-2026-64832 HIGH 8.8 UPGRADE FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder wit
• CVE-2026-71539 HIGH 8.9 n8n is an open source workflow automation platform
• CVE-2026-73122 HIGH 7.7 A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM)
• CVE-2026-91766 MEDIUM 5.9 UPGRADE When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Pro
• CVE-2026-110837 HIGH 7.1 UPGRADE FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer ove
• CVE-2026-114102 HIGH 7.5 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash
• CVE-2026-64663 MEDIUM 6.5 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-72770 MEDIUM 6.5 UPGRADE n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-ta
• CVE-2026-73619 MEDIUM 6.5 UPGRADE GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --a
• CVE-2023-23599 MEDIUM 6.5 UPGRADE UPGRADE When copying a network request from the developer tools panel as a curl command the output was not being prope
• CVE-2026-114727 HIGH 8.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when
• CVE-2026-16629 MEDIUM 5.3 A vulnerability was identified in danger danger-js up to 13.0.7
• CVE-2026-70454 HIGH 8.0 rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate
• CVE-2026-106565 MEDIUM 5.9 UPGRADE ImageMagick is free and open-source software used for editing and manipulating digital images
• CVE-2026-106567 MEDIUM 5.9 UPGRADE ImageMagick is free and open-source software used for editing and manipulating digital images
• CVE-2026-53454 MEDIUM 6.9 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-67326 HIGH 7.0 UPGRADE GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allo
• CVE-2026-69097 HIGH 7.0 UPGRADE GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inje
• CVE-2024-9355 MEDIUM 6.5 A vulnerability was found in Golang FIPS OpenSSL
• CVE-2025-11713 HIGH 8.1 UPGRADE UPGRADE Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpe
• CVE-2026-114112 HIGH 8.9 Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote c
• CVE-2026-52876 HIGH 8.8 Streambert is a cross-platform Electron Desktop App to stream and download video content
• CVE-2026-55967 HIGH 7.5 UPGRADE AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly
• CVE-2026-64833 HIGH 7.1 UPGRADE FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allow
• CVE-2026-65598 HIGH 7.5 UPGRADE n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation tha
• CVE-2024-28834 MEDIUM 5.3 A flaw was found in GnuTLS
• CVE-2026-114111 HIGH 8.9 sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) t
• CVE-2026-65703 HIGH 7.8 UPGRADE FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that
• CVE-2026-71434 MEDIUM 5.3 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-106568 MEDIUM 5.3 UPGRADE ImageMagick is free and open-source software used for editing and manipulating digital images
• CVE-2026-114145 HIGH 7.5 GitPython is a python library used to interact with Git repositories
• CVE-2026-48097 HIGH 7.8 NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP add
• CVE-2026-57208 MEDIUM 6.2 Entire CLI hooks into Git workflows to capture AI agent sessions
• CVE-2026-64662 MEDIUM 6.5 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-73621 MEDIUM 5.4 UPGRADE GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwa
• CVE-2026-50056 HIGH 7.8 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) a
• CVE-2026-41447 HIGH 7.8 FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to exe
• CVE-2026-50057 HIGH 7.8 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix
• CVE-2026-65705 HIGH 7.8 UPGRADE FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filte
• CVE-2026-65706 HIGH 7.8 UPGRADE FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter
• CVE-2026-114097 HIGH 7.8 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter()
• CVE-2026-48098 HIGH 7.3 NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP add
• CVE-2026-71435 MEDIUM 6.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-73282 MEDIUM 4.8 UPGRADE In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forward
• CVE-2026-93640 HIGH 7.8 A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS
• CVE-2026-72718 HIGH 7.0 goose is general-purpose AI agent that runs on your machine
• CVE-2026-74890 MEDIUM 5.5 UPGRADE openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that di
• CVE-2026-113354 MEDIUM 6.5 Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:e
• CVE-2026-75857 HIGH 7.0 CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_inter
• CVE-2026-91769 MEDIUM 4.3 UPGRADE PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no
• CVE-2024-28835 MEDIUM 5.0 A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a spe
• CVE-2026-106070 LOW 3.7 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entr
• CVE-2026-114723 LOW 3.7 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed d
• CVE-2026-58045 MEDIUM 6.2 A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono
• CVE-2026-73506 MEDIUM 6.1 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer
• CVE-2026-75057 MEDIUM 6.2 UPGRADE In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
• CVE-2026-64664 MEDIUM 4.3 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-12565 MEDIUM 5.3 The unarchive internal module's archive extraction commands perform no code-level validation on extracted file
• CVE-2026-73281 LOW 3.5 UPGRADE In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locall
• CVE-2026-71212 MEDIUM 4.4 xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and dow
• CVE-2026-106566 MEDIUM 4.0 UPGRADE ImageMagick is free and open-source software used for editing and manipulating digital images
• CVE-2026-53759 LOW 2.0 linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations
• CVE-2026-73283 LOW 2.5 UPGRADE In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tun
• CVE-2026-115724 LOW 2.9 VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() tha
• CVE-2026-78066 HIGH n/a Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-cont
• CVE-2026-86413 HIGH n/a When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects,
• CVE-2026-92387 HIGH n/a By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can explo
• CVE-2026-94265 HIGH n/a When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might er
• CVE-2026-86410 HIGH n/a A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting
• CVE-2026-86412 HIGH n/a A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload
• CVE-2026-86414 HIGH n/a An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos
• CVE-2026-87862 HIGH n/a Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child
• CVE-2026-87865 HIGH n/a When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key vali
• CVE-2026-92386 HIGH n/a When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write
• CVE-2026-92388 HIGH n/a When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings,
• CVE-2026-92389 HIGH n/a libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, acc
• CVE-2026-92390 HIGH n/a When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protect
• CVE-2026-92391 HIGH n/a A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl dur
• CVE-2026-94266 HIGH n/a libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing
• CVE-2026-107928 HIGH n/a When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer
• CVE-2026-94140 HIGH n/a Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync ha
• CVE-2026-87864 HIGH n/a Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal whi
• CVE-2026-86415 HIGH n/a libcurl's connection cache match function never considers the automatic client certificate option, so a cached
• CVE-2026-87866 HIGH n/a When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer do

FAQ

How do I fix Core tools and libraries vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Core tools and libraries being exploited right now?

Yes: 1 Core tools and libraries CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Core tools and libraries CVE should I patch first?

CVE-2026-60004 currently ranks highest (97/100): Gitea Code Injection Vulnerability.

Software in this group

People search for: openssl, openssh, curl, git, 7-zip, winrar, library.

← Back to latest CVEs