23817 matches found
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API...
Open Redirect
Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Open Redirect in the GitLab pagination handling, which follows the URL given in a Link header and attaches the GitLab credentials to the next-page request without confining the follow to the original...
CVE-2026-88880
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
CVE-2026-88880 Renovate before 44.11.3 Credential Exfiltration via Link Header
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
CVE-2026-88880
Renovate before 44.11.3 contains a credential exfiltration vulnerability in its handling of Link headers when following GitLab server pagination . Because Renovate fails to validate Link header destinations, an attacker controlling a compromised GitLab server can specify a Link header pointing to...
CVE-2026-88880 Renovate before 44.11.3 Credential Exfiltration via Link Header
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
EUVD-2026-75430
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
CVE-2026-88880 Renovate before 44.11.3 Credential Exfiltration via Link Header
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
CVE-2026-88880: URL Redirection to Untrusted Site
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
Gitlab -- vulnerabilities
Gitlab reports: Path Traversal issue in repository commits API impacts GitLab CE/EE Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE Scheduled Pipeline Execution Policy test allows Developers ...
GitLab Unauthenticated Arbitrary File Read
This module exploits CVE-2026-85706, an unauthenticated arbitrary file read in the GitLab repository commits and files APIs. A path parsing discrepancy between GitLab Workhorse and Rails allows unsigned upload metadata to reach the Rails handler, where an attacker-controlled local path is read...
PT-2026-89391
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...
CVE-2026-67321 vulnerabilities
Vulnerabilities for packages: kibana, langfuse, librechat, redisinsight, jitsucom-jitsu, wazuh-dashboard, nextcloud-server, langfuse-fips, opensearch-dashboards, gitlab-rails-ce, kubeflow-centraldashboard, awx, lerna, semaphore, wazuh-dashboard-fips, azurite, prism, opensearch-dashboards-fips,...
GHSA-6GMQ-8VP8-GCM6 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, sqlpad, wazuh-dashboard, gitlab-rails-ce-fips, wazuh-dashboard-fips...
GHSA-JMR9-QJV8-65GV vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce...
CVE-2026-83610 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, sqlpad, wazuh-dashboard, gitlab-rails-ce-fips, wazuh-dashboard-fips...
GHSA-F5VJ-F2HX-8M93 vulnerabilities
Vulnerabilities for packages: arangodb, gitlab-rails-ce, gitlab-rails-ce-fips, argo-workflows...
GHSA-M28W-2PQF-7QGJ vulnerabilities
Vulnerabilities for packages: arangodb, gitlab-rails-ce, gitlab-rails-ce-fips, argo-workflows...