GHSA-874M-FCC5-9GQF vulnerabilities

Vulnerabilities for packages: crossplane-function-extra-resources, crossplane-provider-aws-ivs-fips, newrelic-fluent-bit-output, amazon-eks-ami-fips, kube-logging-logging-operator, terraform-provider-kubernetes-fips, cluster-api-provider-vsphere-fips, litmus-chaos-operator,...

CVE-2026-94440 vulnerabilities

Vulnerabilities for packages: crossplane-function-extra-resources, crossplane-provider-aws-ivs-fips, newrelic-fluent-bit-output, amazon-eks-ami-fips, kube-logging-logging-operator, terraform-provider-kubernetes-fips, cluster-api-provider-vsphere-fips, litmus-chaos-operator,...

CVE-2026-56857 vulnerabilities

Vulnerabilities for packages: consul-k8s-fips, kyverno, zitadel, commercial-gitlab-workhorse-ee, loki, containerd, external-dns, flux, cosign-fips, omnictl-multiarch-fips, kube-conformance, tigera-operator, commercial-gitlab-workhorse-ee-fips, qemu-guesthelper, commercial-gitlab-rails-ee-fips,...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: grafana, prometheus-adapter, ingress-nginx-controller, argo-cd, opencost, terragrunt, falco-no-driver, kyverno-policy-reporter, hubble-ui, filebrowser, flux-source-controller, cert-manager, loki, rclone, kyverno-policy-reporter-ui, argo-workflows,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: grafana, prometheus-adapter, ingress-nginx-controller, argo-cd, opencost, terragrunt, falco-no-driver, kyverno-policy-reporter, hubble-ui, filebrowser, flux-source-controller, cert-manager, loki, rclone, kyverno-policy-reporter-ui, argo-workflows,...

CVE-2022-1162

CVE-2022-1162 A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. Exploit: New Gitlab Accounts...

duo-agentflow-auditor

Duo AgentFlow Auditor AI Code Security — catching what SAST misses in AI-generated code Built on the GitLab Duo Agent Platform 40-62% of AI-generated code contains security vulnerabilities. Traditional SAST catches CVEs. We catch what SAST misses — prompt injection, LLM output execution, unsafe M...

blueborne-CVE-2017-1000251

blueborne-CVE-2017-1000251 https://gitlab.com/marcinguy/blueborne-CVE-2017-1000251...

GitLab-cve-2021-22205-nse

Script para realizar fingerprinting de una instancia de GItLab en busca de CVE-2021-22205 por Frank breedijk de DIVD.nl...

gitlab-rce-demo

GitLab Oj RCE Demo Questo repository contiene una demo autonoma per la catena di RCE notebook-diff di GitLab descritta nella nostra ricerca. Avvia un container GitLab 18.11.3 pulito, crea un utente normale tramite l'interfaccia HTTP pubblica ed esegue il PoC contro tale istanza. Dettagli tecnici:...

CVE-2023-7028

CVE-2023-7028 | Toma de control de cuenta en GitLab Descargo de responsabilidad Este código es una prueba de concepto de la vulnerabilidad. No animo a nadie a usarlo en instancias de GitLab que no le pertenezcan. Esta herramienta ha sido desarrollada únicamente con fines de investigación y...

LeitWacht Agent

leitwacht-agent https://leitwacht.eu — source of truth: https://gitlab.com/leitwacht/leitwacht-agent. Issues, MRs, and discussions live on GitLab. Pre-1.0. The 0.x series is pre-stable; minor releases may carry breaking changes to APIs, env-var names, helm values.yaml keys, and rule-file schema...

GitLab CE/EE - Hard-Coded Credentials

GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML, allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab...

GitLab 16.0.0 - Path Traversal

An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups id: CVE-2023-2825 info: name:...

GitLab CE/EE - Remote Code Execution

GitLab CE/EE 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 is susceptible to remote code execution. An authenticated user authorized to import projects can import a maliciously crafted project, thus possibly being able to execute malware, obtain sensitive information, modi...

Mnemosyne

Mnemosyne My personal infosec memo Fun fact The name of this project comes from the Greek goddess of memory: Mnemosyne. Moreover and regarding our story, it is interesting to note that, it's the origin of the word memory. Usage Mnemosyne is publicly available on the sub-domain of the same name of...

CVE-2026-85706

CVE-2026-85706: GitLab CE/EE Unauthenticated Path Traversal CVE : CVE-2026-85706, CVSS 3.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Component : GitLab CE/EE Repository Commits API Workhorse body-upload variant Affected : 18.7 ≤ version 19.1.8, 19.2.0–19.2.5, 19.3.0–19.3.1 Fixed : 19.1.8 / 19.2.6 ...

CVE-2023-2825-Gitlab

CVE-2023-2825 On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug. It wa...

CVE-2023-7028

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability Overview This repository contains an exploit for CVE-2023-7028 , a critical vulnerability in GitLab that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts...

cve-2020-10977

CVE-2020-10977 GitLab 12.9.0 Lectura Arbitraria de Archivos Objetivo : 12.9.0 e inferiores Probado : GitLab 12.8.1 En una reciente evaluación encontré una instancia de GitLab en el objetivo, encontré un PoC en Exploit-DB pero usa LDAP para autenticación y en este caso estaba deshabilitado, así qu...