CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 25/06/2024 |
| CVE-2024-3817 | KRITISCH9.8 | HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.
This vulnerability does not affect the go-getter/v2 branch and package. | 17/04/2024 |
| CVE-2023-0475 | MITTEL6.5 | HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. | 16/02/2023 |
| CVE-2022-26945 | KRITISCH9.8 | go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0. | 25/05/2022 |
| CVE-2022-29810 | MITTEL5.5 | The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. | 27/04/2022 |