GHSA-395F-4HP3-45GV vulnerabilities

Vulnerabilities for packages: code-server, gitlab-rails-ce-fips, gitlab-rails-ce, arangodb, gemini-cli, argo-workflows...

GHSA-PGGX-2V9R-J6GM vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-12506 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-H5PW-H3J7-CJ7F vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-7492 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-M49F-RVV4-R4RV vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2026-13320 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

Uninitialized GitLab instances Detection

Prior to version 14, GitLab installations required a root password to be set via the web UI. If the administrator skipped this step, any visitor could set a password and control the instance. !/usr/bin/env python3 -- coding: utf-8 -- """Prior to version 14, GitLab installations required a root...

GitLab CE/EE - Hard-Coded Credentials Detection

GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML, allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab...

Fedora 43 : opkssh (2026-168280f3c4)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-168280f3c4 advisory. Update to 0.16.0. This release includes a security fix for GQ-commitment PK Tokens upgrades the openpubkey dependency to v0.25.0, addressing a vulnerability...

Malicious Package

Overview delivery-ci-update-gitlab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

cicd-sensor rules/v20260722-001

🚧 Pre-release: Active development. cicd-sensor is currently in pre-release and under active development. Feedback is very welcome. cicd-sensor Think EDR, but for CI/CD Pipelines. Open-source eBPF-powered runtime security sensor for GitHub Actions and GitLab CI/CD. → Full documentation Demo ---...

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...

elemeno-ai-sdk (>=0.0.5, <=0.0.20), foresthog (>=0.9.0, <=1.3.6) +7 more potentially affected by CVE-2026-73622 via gitpython (2.1.1)

gitpython PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elemeno-ai-sdk =0.0.5, =0.9.0, =0.1.0, =0.4.0, =0.0.5, =0.0.1, =1.0.0, =1.0.4, =1.0.10 Source cves: CVE-2026-73622 Source advisory:...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-73622 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-73622 Source advisory: OSV:GHSA-94P4-4CQ8-9G67...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-73625 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-73625 Source advisory: OSV:GHSA-R9MR-M37C-5FR3...

elemeno-ai-sdk (>=0.0.5, <=0.0.20), foresthog (>=0.9.0, <=1.3.6) +7 more potentially affected by CVE-2026-73625 via gitpython (2.1.1)

gitpython PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elemeno-ai-sdk =0.0.5, =0.9.0, =0.1.0, =0.4.0, =0.0.5, =0.0.1, =1.0.0, =1.0.4, =1.0.10 Source cves: CVE-2026-73625 Source advisory:...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-73625 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-73625 Source advisory: OSV:GHSA-R9MR-M37C-5FR3...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-73623 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-73623 Source advisory: OSV:GHSA-6P8H-3WGX-97GF...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-73623 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-73623 Source advisory: OSV:GHSA-6P8H-3WGX-97GF...