21966 matches found
PT-2026-65879
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing...
PT-2026-65882
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in...
CVE-2026-13311 vulnerabilities
Vulnerabilities for packages: arangodb, code-server, gitlab-rails-ce-fips...
GHSA-395F-4HP3-45GV vulnerabilities
Vulnerabilities for packages: arangodb, code-server, gitlab-rails-ce-fips...
GHSA-H5PW-H3J7-CJ7F vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GHSA-PGGX-2V9R-J6GM vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GHSA-M49F-RVV4-R4RV vulnerabilities
Vulnerabilities for packages: gitlab-runner...
CVE-2025-12506 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
CVE-2026-7492 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
CVE-2026-13320 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GitLab - Account Takeover via Password Reset
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
GHSA-P2F4-R6V6-J797 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: actions-runner, kubeflow-centraldashboard, graalvm, sqlpad, code-server, gitlab-rails-ce-fips, opensearch-dashboards, kibana, lerna, wazuh-dashboard, saf, gitlab-rails-ce, prism, opensearch-dashboards-fips, wazuh-dashboard-fips, homepage, pulumi, npm...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: actions-runner, kubeflow-centraldashboard, graalvm, sqlpad, code-server, gitlab-rails-ce-fips, opensearch-dashboards, kibana, lerna, wazuh-dashboard, saf, gitlab-rails-ce, prism, opensearch-dashboards-fips, wazuh-dashboard-fips, homepage, pulumi, npm...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: actions-runner, kubeflow-centraldashboard, graalvm, sqlpad, code-server, gitlab-rails-ce-fips, opensearch-dashboards, kibana, lerna, wazuh-dashboard, saf, gitlab-rails-ce, prism, opensearch-dashboards-fips, wazuh-dashboard-fips, pulumi, npm...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: actions-runner, kubeflow-centraldashboard, graalvm, sqlpad, code-server, gitlab-rails-ce-fips, opensearch-dashboards, kibana, lerna, wazuh-dashboard, saf, gitlab-rails-ce, prism, opensearch-dashboards-fips, wazuh-dashboard-fips, homepage, pulumi, npm...