EUVD-2026-38246

Mattermost versions 11.7.x slash command.. Mattermost Advisory ID: MMSA-2026-00644...

CVE-2026-5139

Mattermost plugin vulnerability CVE-2026-5139 affects Mattermost versions 11.7.x ≤ 11.7.0, 11.6.x ≤ 11.6.2, 11.5.x ≤ 11.5.5, 10.11.x ≤ 10.11.17. The issue arises in the /gitlab connect command handler where administrator authorization is not enforced for the setDefaultInstance call, allowing any ...

CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

Mattermost versions 11.7.x slash command.. Mattermost Advisory ID: MMSA-2026-00644...

CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration

Mattermost versions 11.7.x slash command.. Mattermost Advisory ID: MMSA-2026-00644...

PT-2026-51304

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost version 11.6.2 Mattermost version 11.5.5 Mattermost version 10.11.17 Description Improper authorization in the GitLab connect command handler allows any authenticated user to overwrite the global default...

GHSA-CX4G-HR74-M89M vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

GHSA-C4M8-PV9J-V7MM vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

CVE-2026-6277 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

CVE-2026-8589 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

CVE-2026-6976 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

CVE-2026-9204 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

CVE-2026-6552 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce, gitlab-runner, gitlab-cng, gitlab-rails-ce, gitlab-runner-fips, gitlab-workhorse-ce-fips...

CVE-2026-7250 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

GHSA-Q9J8-24P8-JQ8J vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

GHSA-HM74-P2XF-RQGC vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

GHSA-5CR4-QWVX-32J2 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

GHSA-R82J-G6Q9-MVX8 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce, gitlab-runner, gitlab-cng, gitlab-rails-ce, gitlab-runner-fips, gitlab-workhorse-ce-fips...

GHSA-7MQ5-3VCF-V96V vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

CVE-2026-9694 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-runner, gitlab-runner-fips, gitlab-cng...

MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...