https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:17:26.329761+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33353 CVE-2026-33353 — Soft Serve: Authenticated repo import can clone server-local private repositories 2026-10-07T07:17:26.345801+00:00

Affected: charmbracelet soft-serve

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This issue has been patched in version 0.11.6.