CVE-2026-42195

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...

PT-2026-40876

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.7 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2 Description An issue in customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: kubescape, witness, apko, goreleaser, gitea, trivy-operator, flux-image-automation-controller, act, grafana-alloy, steampipe, gitsign, flux-source-controller, cerbos, scorecard, zot, argo-events, gitaly, gitlab-runner, snyk-cli, trivy, zarf, guac,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: kubescape, witness, apko, goreleaser, gitea, trivy-operator, flux-image-automation-controller, act, grafana-alloy, steampipe, gitsign, flux-source-controller, cerbos, scorecard, zot, argo-events, gitaly, gitlab-runner, snyk-cli, trivy, zarf, guac,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, witness, rancher-fleet, rancher-fleet-fips, kyverno, nuclei, grype-db, mapotf-fips, chainctl-fips, src-fingerprint-fips, packer, nfpm, trivy-fips, trivy, coder-fips, trivy-operator-fips, kots, kubescape, gitaly-fips,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, witness, rancher-fleet, rancher-fleet-fips, kyverno, nuclei, grype-db, mapotf-fips, chainctl-fips, src-fingerprint-fips, packer, nfpm, trivy-fips, trivy, coder-fips, trivy-operator-fips, kots, kubescape, gitaly-fips,...

GHSA-526F-JXPJ-JMG2 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-43870 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-44836 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-HG3H-G7XC-F7VP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-7F3R-GWC9-2995 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-44837 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2026-40295 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-JP94-3292-C3XV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of mcp-gitlab-server at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a uncovered that the SSE HTTP transport — advertised in the README and comparison table as a...

GHSA-8JR5-6GVJ-RFPF @yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of mcp-gitlab-server at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a uncovered that the SSE HTTP transport — advertised in the README and comparison table as a...

PT-2026-39306

Name of the Vulnerable Software and Affected Versions GitLab MCP Server versions prior to 0.6.0 Description The HTTP transport in src/transport.ts lacks an authentication layer and implements a wildcard Access-Control-Allow-Origin: header on all responses. This allows any cross-origin browser...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-67326 Source advisory: OSV:GHSA-MV93-W799-CJ2W...

CVE-2026-42195

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...