21289 matches found
PT-2026-39306
Name of the Vulnerable Software and Affected Versions GitLab MCP Server versions prior to 0.6.0 Description The HTTP transport in src/transport.ts lacks an authentication layer and implements a wildcard Access-Control-Allow-Origin: header on all responses. This allows any cross-origin browser...
CVE-2026-42195
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
EUVD-2026-28833
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...
CVE-2026-42195
The CVE describes a vulnerability in the draw.io client prior to version 29.7.9 where a ?gitlab= URL parameter can override the GitLab server URL used during OAuth sign-in. A crafted link can force the user’s click on the "Authorize in GitLab" dialog to open a popup on an attacker-controlled host...
GHSA-C4RQ-3M3G-8WGX vulnerabilities
Vulnerabilities for packages: pact-broker-docker-fips, ruby3.2-rails, ruby3.3-rails, ruby3.4-rails, ruby4.0-rails, kube-logging-operator, pact-broker-docker...
CVE-2026-44312 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...
GHSA-V2FC-QM4H-8HQV vulnerabilities
Vulnerabilities for packages: pact-broker-docker-fips, ruby3.2-rails, ruby3.3-rails, ruby3.4-rails, ruby4.0-rails, kube-logging-operator, pact-broker-docker...
GHSA-FF6C-W6QF-7XQC vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...
CVE-2026-41636 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
GHSA-R67J-R569-JRWP vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
PT-2026-39197
Name of the Vulnerable Software and Affected Versions draw.io versions prior to 29.7.9 Description The application accepts a gitlab URL parameter that overrides the GitLab server URL used during OAuth sign-in. An attacker can use a crafted link to cause the "Authorize in GitLab" dialog to open a...
draw.io 信息泄露漏洞
Draw.IO is an open-source configurable chart drawing and whiteboard application. Versions of Draw.IO prior to 29.7.9 had a vulnerability related to information leakage. This vulnerability occurred due to the URL parameter “gitlab” overriding the GitLab server URL used during OAuth login. As a...
CVE-2026-41889 vulnerabilities
Vulnerabilities for packages: openbao, cerbos, bento-fips, wal-g, certificate-transparency-fips, sftpgo-plugin-eventsearch, cloudnative-pg, seaweedfs, gitlab-cng, juicefs, falcosidekick-fips, rke2-runtime, step-ca, ferretdb, spqr, dapr-fips, gitlab-cng-fips, gitness, telegraf, pgwatch,...
CVE-2026-41506 vulnerabilities
Vulnerabilities for packages: crossplane, kyverno, apko-fips, cerbos, dagger, pulumi, pulumi-kubernetes-operator, trivy-fips, grype, external-secrets-operator-fips, gitlab-runner-fips, kubescape-server, kubevela, flux, kargo, witness, kots, grafana-fips, skaffold-fips, trufflehog, src-fingerprint...
GHSA-Q2MW-FVJ9-VVCW vulnerabilities
Vulnerabilities for packages: ruby3.3-net-imap, ruby3.2-net-imap, kube-logging-operator, ruby3.2-rails, logstash, ruby3.3-rails, gitlab-rails-ce, ruby3.4-net-imap, ruby3.4-rails, gitlab-rails-ce-fips, ruby4.0-net-imap, logstash-fips, ruby4.0-rails...
GHSA-87PF-FPWV-P7M7 vulnerabilities
Vulnerabilities for packages: ruby3.3-net-imap, ruby3.2-net-imap, kube-logging-operator, ruby3.2-rails, logstash, ruby3.3-rails, gitlab-rails-ce, ruby3.4-net-imap, ruby3.4-rails, gitlab-rails-ce-fips, ruby4.0-net-imap, logstash-fips, ruby4.0-rails...
GHSA-75XQ-5H9V-W6PX vulnerabilities
Vulnerabilities for packages: ruby3.3-net-imap, ruby3.2-net-imap, kube-logging-operator, ruby3.2-rails, logstash, ruby3.3-rails, gitlab-rails-ce, ruby3.4-net-imap, ruby3.4-rails, gitlab-rails-ce-fips, ruby4.0-net-imap, logstash-fips, ruby4.0-rails...