CVE-2026-87719

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials...

CVE-2026-87719

GitLab Enterprise Edition (EE) is affected by an insecure deserialization flaw in the GraphQL subscription serializer . An authenticated user with Duo Chat access can craft a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup, exposing Advance...

CVE-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials...

CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

Incorrect Authorization vulnerability in ash-project ashgraphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, dosend/5 resolves the first notification of a batch and filters it with shouldsend?/1, which drops results...

EUVD-2023-2063

Malicious code in bioql PyPI...

CVE-2023-38503

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters i.e. usercreated IS $CURRENTUSER are not properly checked when using GraphQL subscription resulting in unauthorized users getting event o...

GitLab CE/EE 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab CE/EE versions 16.7 through 16.9.6, 16.10...

PT-2024-5145 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.7 through 16.9.5 GitLab CE/EE versions 16.10 through 16.10.3 GitLab CE/EE versions 16.11 through 16.11.0 Description: The issue is related to the GraphQL Subscription Handler component of the GitLab platform, which...