24602 matches found
CVE-2026-6336: Incorrect Authorization
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...
CVE-2026-13311 vulnerabilities
Vulnerabilities for packages: argo-workflows, gitlab-rails-ce, arangodb, gemini-cli, gitlab-rails-ce-fips, code-server...
GHSA-395F-4HP3-45GV vulnerabilities
Vulnerabilities for packages: argo-workflows, gitlab-rails-ce, arangodb, gemini-cli, gitlab-rails-ce-fips, code-server...
GHSA-H5PW-H3J7-CJ7F vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GHSA-PGGX-2V9R-J6GM vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GHSA-M49F-RVV4-R4RV vulnerabilities
Vulnerabilities for packages: gitlab-runner...
CVE-2026-13320 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
CVE-2025-12506 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
CVE-2026-7492 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
GHSA-P2F4-R6V6-J797 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, kibana, opensearch-dashboards-fips, pulumi, opensearch-dashboards, npm, homepage, sqlpad, gitlab-rails-ce, actions-runner, saf, graalvm, kubeflow-centraldashboard, wazuh-dashboard-fips, lerna, gitlab-rails-ce-fips, code-server, prism...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, kibana, opensearch-dashboards-fips, pulumi, opensearch-dashboards, npm, homepage, sqlpad, gitlab-rails-ce, actions-runner, saf, graalvm, kubeflow-centraldashboard, wazuh-dashboard-fips, lerna, gitlab-rails-ce-fips, code-server, prism...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, kibana, opensearch-dashboards-fips, pulumi, opensearch-dashboards, npm, sqlpad, gitlab-rails-ce, actions-runner, saf, graalvm, kubeflow-centraldashboard, wazuh-dashboard-fips, lerna, gitlab-rails-ce-fips, code-server, prism...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, kibana, opensearch-dashboards-fips, pulumi, opensearch-dashboards, npm, homepage, sqlpad, gitlab-rails-ce, actions-runner, saf, graalvm, kubeflow-centraldashboard, wazuh-dashboard-fips, lerna, gitlab-rails-ce-fips, code-server, prism...
GHSA-MP7J-QC5W-4988 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, argo-workflows, arangodb...
CVE-2026-54466 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips, argo-workflows, arangodb...