27267 matches found
CVE-2026-43870 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
CVE-2026-44836 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
GHSA-7F3R-GWC9-2995 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
GHSA-HG3H-G7XC-F7VP vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
CVE-2026-44837 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
CVE-2026-40295 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
GHSA-JP94-3292-C3XV vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of mcp-gitlab-server at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a uncovered that the SSE HTTP transport — advertised in the README and comparison table as a...
GHSA-8JR5-6GVJ-RFPF @yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of mcp-gitlab-server at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a uncovered that the SSE HTTP transport — advertised in the README and comparison table as a...
PT-2026-39306
Name of the Vulnerable Software and Affected Versions GitLab MCP Server versions prior to 0.6.0 Description The HTTP transport in src/transport.ts lacks an authentication layer and implements a wildcard Access-Control-Allow-Origin: header on all responses. This allows any cross-origin browser...
dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-42215 +1 more via gitpython (2.1.5)
gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-42215, CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...
bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-42215 +1 more via gitpython (2.1.3)
gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-42215, CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2...
CVE-2026-42195
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
EUVD-2026-28833
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195
The CVE describes a vulnerability in the draw.io client prior to version 29.7.9 where a ?gitlab= URL parameter can override the GitLab server URL used during OAuth sign-in. A crafted link can force the user’s click on the "Authorize in GitLab" dialog to open a popup on an attacker-controlled host...