vexhub-crawler

VEX Hub Crawler vexhub-crawler — это компонент VEX Hub, который автоматически получает VEX-документы из исходных репозиториев. Обзор Краулер определяет исходные репозитории по зарегистрированным PURL Package URLs и копирует VEX-документы в VEX Hub. Этот процесс гарантирует, что VEX Hub поддержива...

deptrust

deptrust root@kitploit: / / / / / / / / / / / / / / / / / / / // / / // / / // / ,// ./// ,/// // deptrust est un CLI qui vérifie les versions de paquets pour détecter des vulnérabilités connues sur npm, PyPI, crates.io, les modules Go, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods,...

proxy

git-pkgs プロキシ パッケージレジストリ用のキャッシングプロキシです。アーティファクトをローカルにキャッシュすることでパッケージのダウンロードを高速化し、帯域幅の使用量を削減して信頼性を向上させます。 バージョン・クールダウン ほとんどのサプライチェーン攻撃は速度に依存しています。悪意のあるバージョンが公開されると、誰も気づかないうちに数分以内に自動化パイプラインに消費されてしまいます。クールダウン機能は、新しく公開されたバージョンに検疫期間を追加します。有効にすると、プロキシは設定可能なしきい値を超えて経過するまで、メタデータ応答からバージョンを除外します。yaml...

CVE-2026-10053-lab

CVE-2026-10053 — воспроизводимая лаборатория проверки Автономная лаборатория, которая доказывает обход пути в npm-реестре пакетов GitLab CVE-2026-10053, и показывает, что исправление его блокирует, используя детерминированный файловый оракул, а не HTTP-статус. Что доказано, а что нет. Эта...

BIT-GITLAB-2026-10053 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053

GitLab CE/EE is affected by a path traversal vulnerability in the package registry component that could allow an authenticated user (low privileges) to achieve remote code execution . The vulnerability affects versions 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The CVSS 3.1 s...

EUVD-2026-64645

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

GitLab 18.8 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-10053)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an...

PT-2026-79764

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.8 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An authenticated user can achieve remote code execution due to a path traversal flaw in the package...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-iot-fips, crossplane-provider-aws-dataexchange, crossplane-provider-aws-account-fips, crossplane-provider-aws-serverlessrepo-fips, crossplane-provider-aws-schemas, crossplane-provider-aws-route53recoveryreadiness,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: fulcio, tekton-chains, sops, rekor, spire-server, cosign, falcoctl-fips, terragrunt, oauth2-proxy, flux-kustomize-controller, slsa-verifier, vexctl, dex, fulcio-fips, flux-source-controller, cosign-fips, gitsign, kubescape, kots, aactl, cloudflared,...

GO-2026-4980 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, go-openssl, nerdctl-fips, google-cloud-otel-ops-collector, logstash, cadence-fips, policy-bot, tetragon-fips, elastic-agent, argo-events-fips, step-fips, k8s-agents-operator-fips, kubernetes-fips, kubernetes-csi-node-driver-registrar,...

CVE-2026-73415 vulnerabilities

Vulnerabilities for packages: tensorflow-cpu-jupyter...

CVE-2026-8667

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

EUVD-2026-57395

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

CVE-2026-8667

GitLab CE/EE contains an authorization-level issue: under certain conditions an authenticated user with the developer role could modify package registry metadata without maintainer permissions. Affected versions: 17.6 up to 19.0.5, 19.1 up to 19.1.3, and 19.2 up to 19.2.1. Remediation patches rel...

CVE-2026-8667 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

CVE-2026-8667 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...