charmbracelet soft-serve

• CVE-2026-91773 Medium 4.3 Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks 0.3%
• CVE-2026-33353 High 7.1 Soft Serve: Authenticated repo import can clone server-local private repositories 0.4%
• CVE-2026-30832 Critical 9.1 Soft Serve: SSRF via unvalidated LFS endpoint in repo import 0.4%
• CVE-2026-24058 High 8.1 Soft Serve has Critical Authentication Bypass 0.6%
• CVE-2026-22253 Medium 5.4 Soft Serve is missing an authorization check in LFS lock deletion 0.3%
• CVE-2025-64522 Critical 9.1 Soft Serve is vulnerable to SSRF through its Webhooks 0.4%
• CVE-2025-64494 Medium 4.6 Soft Serve does not sanitize ANSI escape sequences in user input 0.2%
• CVE-2025-58355 High 7.7 Soft Serve is vulnerable to arbitrary file writing through its SSH API 0.3%
• CVE-2025-22130 Medium 5.3 Soft Serve allows path traversal attacks 0.7%
• CVE-2024-41956 High 8.1 Soft Serve allows arbitrary code execution by crafting git-lfs requests 0.5%
• CVE-2023-43809 High 7.5 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled 1.2%