CVE-2025-13781

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

BIT-GITLAB-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2025-13781

GitLab EE was affected by a missing authorization check in GraphQL mutations that could let an authenticated user modify instance-wide AI feature provider settings. The issue impacted GitLab EE versions 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1. Remediation involved a patch r...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

CVE-2025-13781: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to modify instance-wide AI feature provider settings by exploiting missing authorization checks in GraphQL mutations...

CVE-2019-12437

In SilverStripe through 4.3.3, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations,...

PT-2026-1715

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.5 through 18.5.4 GitLab EE versions 18.6 through 18.6.2 GitLab EE versions 18.7 through 18.7.0 Description An authenticated user could modify instance-wide AI feature provider settings due to missing authorization checks ...

American Fuzzy Lop plus plus 4.35c

Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc...

BGPFuzz: Automated Configuration Fuzzing of the Border Gateway Protocol

Telecommunications networks rely on configurations to define routing behavior, especially in the Border Gateway Protocol BGP, where misconfigurations can lead to severe outages and security breaches, as demonstrated by the 2021 Facebook outage. Unlike existing approaches that rely on synthesis or...

Malicious code in kisut-difg-diguuota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c372d417f73ef5a6d31e503317e96cb7fbe3e7b11d0c69b52ea4bded4d2bb20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poglymer-ogminmh-abafbbaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 858d7f55123de7d134412cb22d9b24d3b9239e5cb8436a5f0017236fbc7c4739 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hereis-manuic-tauwaaaja (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78dc5d5e6a8e2a9cebe7296ede97d0814351bc309a2d3f55f69d418c0da64d81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171492 Malicious code in leecsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e6ae65dd31a686cfb0fb2e85b3e45a655b59e01241d2f23f19f2aef3a99917 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sabuda-muyu-bgagfaug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92ab4b643cb19e67ba546c21d673a971f9ca17a7231ddfd4bdd166404ee1cb02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-manaki9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21eec2549c7a6f0bc74783df5574344010ac9195a55435d51b82d24bcd2a360 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163201 Malicious code in nokire-nana47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3deff3095daa2f04195a104e45620a9b032ddf321d56fc3440b9563688187c7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155766 Malicious code in hariyono-poke49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ae41fafcbdbab23d114edef996ab26bc444ff801c0d5c6672238a2b575d9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...