CVE-2026-56876 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

CVE-2026-14620 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, argo-workflows, arangodb, gitlab-rails-ce-fips...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.4-rails, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, kube-logging-operator...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.4-rails, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, kube-logging-operator...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.2-rails, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.4-rails, ruby3.3-rails, gitlab-rails-ce, ruby4.0-rails, kube-logging-operator...

CICD-Goat-Vapt-Writeup — Updated!

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

EUVD-2026-70130

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

BIT-GITLAB-2026-4398 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own...

GHSA-6MXV-C89J-2494 vulnerabilities

Vulnerabilities for packages: gitlab-kas, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-rails-ce-fips, gitlab-cng-fips, gitlab-cng, gitlab-rails-ce, gitlab-workhorse-ce...

CVE-2026-77801 vulnerabilities

Vulnerabilities for packages: gitlab-kas, gitlab-runner, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-rails-ce-fips, gitlab-cng-fips, gitlab-cng, gitlab-rails-ce, gitlab-workhorse-ce...

CVE-2026-77801 vulnerabilities

Vulnerabilities for packages: gitlab-kas, gitlab-runner...

GHSA-6MXV-C89J-2494 vulnerabilities

Vulnerabilities for packages: gitlab-kas, gitlab-runner...

PT-2026-84787

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

CVE-2026-84664: Modification of Assumed-Immutable Data (MAID)

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

Improper access control in gitlab-plugin allows SSRF

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...

BIT-GITLAB-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...