CVE Tools
Track your stack

Matt-mackall

3 CVEs tracked since 2018. Since Jul 2018, none of them reached CISA KEV.

Matt-mackall CVEs per month

Jul 2018 to Jul 2018. Point at a month, or focus the strip and use the arrow keys.
Matt-mackall CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-0730

Products

The products that kept showing up in Matt-mackall's monthly top three, with their CVEs summed over those months.

  1. Mercurial31 month

Latest CVEs

The 9 most recently published vulnerabilities affecting Matt-mackall.

  1. CVE-2025-2361Mercurial SCM Web Interface cross site scripting4.3
  2. CVE-2019-3902A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.5.1
  3. CVE-2018-13346The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.7.5
  4. CVE-2018-13348The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but ac...7.5
  5. CVE-2018-13347mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.9.8
  6. CVE-2018-1000132Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable vi...9.1
  7. CVE-2017-17458In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the r...9.8
  8. CVE-2017-1000116Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.9.8
  9. CVE-2017-9462In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.8.8

The record

Peak rank
#132 in Jul 2018
Busiest month shown
Jul 2018, 3 CVEs
Months with a KEV entry
0 since Jul 2018
Monthly snapshots
1 since 2018
Matt-mackall's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store