Gitlab-Exiftool-RCE

Gitlab-Exiftool-RCE RCE Exploit for Gitlab 13.10.3 GitLab Workhorse will pass any file to ExifTool. The current bug is in the DjVu module of ExifTool. Anyone with the ability to upload an image that goes through the GitLab Workhorse could achieve RCE via a specially crafted file Usage python3...

cve-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read CVSS 10.0 · Unauthenticated · Actively exploited CISA KEV A parser differential between GitLab Workhorse Go reverse proxy and Puma/Grape Ruby lets an unauthenticated attacker bypass Workhorse's accelerated-upload handoff and reach three...

CVE-2026-110264 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, ruby, gitlab-rails-ce-fips...

GHSA-83VQ-RVFF-66GW vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, ruby, gitlab-rails-ce-fips...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, omnictl-multiarch-fips, frankenphp-8.4, flux, commercial-expanso-edge, cosign-fips, ingress-nginx-controller, nemo-gym, karpenter, commercial-chainloop-cli, consul-k8s-fips, kyverno, nvidia-nsight-compute-13.3,...

CVE-2026-92530 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips...

GHSA-WR3R-JHMC-F6JW vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips...

CVE-2026-92628 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips...

CVE-2026-92874 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips...

GHSA-C3RM-3HQR-4QWM vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips...

GO-2026-5031 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, mattermost-fips, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-rocksdb-fips, seaweedfs-operator, seaweedfs-operator-fips, seaweedfs...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, rclone, mattermost, listmonk, mattermost-fips, seaweedfs-fips, seaweedfs-operator, hugo, seaweedfs-operator-fips, rclone-fips, seaweedfs...

GO-2026-5032 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, mattermost-fips, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-rocksdb-fips, seaweedfs-operator, seaweedfs-operator-fips, seaweedfs...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: filebrowser, gitlab-workhorse-ce, rclone, mattermost, hugo-extended, listmonk, mailpit-fips, mattermost-fips, seaweedfs-fips, mailpit, seaweedfs-operator, seaweedfs-rocksdb, seaweedfs-rocksdb-fips, hugo, hugo-fips, seaweedfs-operator-fips, rclone-fips, seaweedfs...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: flux-operator, datadog-agent, ferretdb, gitlab-workhorse-ce, jaeger, jaeger-fips, osv-scanner, glab, gitlab-workhorse-ce-fips, flux-operator-fips, opencost, opencost-fips, datadog-agent-fips, livekit-cli...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: flux-operator, datadog-agent, ferretdb, gitlab-workhorse-ce, jaeger, jaeger-fips, osv-scanner, glab, gitlab-workhorse-ce-fips, flux-operator-fips, opencost, opencost-fips, datadog-agent-fips, livekit-cli...

GHSA-Q675-QJ96-32M9 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, mattermost-fips, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-rocksdb-fips, seaweedfs-operator, seaweedfs-operator-fips, seaweedfs...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: minio, gitea-fips, flux-fips, k3s, kyverno, knative-serving, vault, harbor-fips, terraform, gitlab-workhorse-ce, tigera-operator, opentofu-fips, trivy-fips, knative-serving-fips, grafana-fips, external-secrets-operator, coder, snyk-cli, knative-kafka-broker,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kms-fips, kyverno-policy-reporter-kyverno-plugin-fips, lazygit, knative-serving, govulncheck, cert-exporter-fips, frp, mkcert, apache-beam-python-3.12-sdk, sriov-network-device-plugin, grafana-mimir, act,...

CVE-2026-1182 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, gitlab-workhorse-ce, gitlab-cng-fips, gitlab-rails-ce, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips, gitlab-kas, gitlab-cng, gitlab-kas-fips...