Linux Distros Unpatched Vulnerability : CVE-2026-14814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions,...

PT-2026-115859

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

GitLab < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-14814)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cach...

CVE-2026-14814

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

CVE-2026-14814 Permissive Regular Expression in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

CVE-2026-14814 Permissive Regular Expression in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

CVE-2026-14814: Permissive Regular Expression

GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute special...

PT-2026-111167

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 19.2.8 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1 Description Improper validation of repository references allows a user to poison cached responses for raw repository file...

CVE-2026-70606

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

EUVD-2026-53445

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...

PT-2026-67443

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same...

PT-2026-65763

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 Description The webp transform plugin can decode data unsafely, leading to the delivery...

CVE-2026-64647

A flaw was found in Next.js. This vulnerability allows a remote attacker to potentially access confidential data. When a server-side fetch processes a request with a body using a non-UTF-8 character set, it may incorrectly return a cached response body from a different request to the same URL but...

CVE-2026-64648

A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different body. This could lead to the unauthorized disclosure of...

EUVD-2026-49565

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64647

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-54267

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

Use of Web Browser Cache Containing Sensitive Information

Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to the omission of cache control headers in the handleMobileBundle process. An attacker can obtain sensitive private key material by accessing cached API responses through...

SUSE CVE-2026-8404

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their...