Charm Soft Serve vulnerabilities

• charm soft serve, charmbracelet soft-serve +1 more Soft Serve: Authenticated repo import can clone server-local private repositories CVE-2026-33353 Fix available 7.1 HighMarch 19, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVE-2026-30832 Fix available 9.1 CriticalMarch 6, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve has Critical Authentication Bypass CVE-2026-24058 Fix available 8.1 HighJanuary 21, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve is missing an authorization check in LFS lock deletion CVE-2026-22253 Fix available 5.4 MediumJanuary 8, 2026
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve is vulnerable to SSRF through its Webhooks CVE-2025-64522 Fix available 9.1 CriticalNovember 10, 2025
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve allows path traversal attacks CVE-2025-22130 Fix available 5.3 MediumJanuary 8, 2025
• charm soft serve, charmbracelet soft-serve +1 more Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVE-2023-43809 Fix available 7.5 HighOctober 2, 2023