EUVD-2026-60371

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

CVE-2026-19650

In GitLab CE/EE, improper request validation in GraphQL multiplex query handling allowed an unauthenticated user to execute mutations via GET requests. Affected versions are 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVSS 3.1 scores 7.1 (HIGH), with high...

CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-19478

GitLab CE/EE (self-managed) versions 18.2 through 19.2.3 are affected by a critical unauthenticated arbitrary method invocation vulnerability (CVSS 9.4, CWE-94) in the GraphQL API. The root cause is in the @gl_introduced directive's fallback field resolver (future_field_fallback.rb), which calls ...

EUVD-2026-60443

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

MINI-67X2-GCQ9-RF3C

Bulletin has no description...

CVE-2026-63667

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

MINI-V7R3-WQM8-QWVQ

Bulletin has no description...

MINI-8V23-4463-GWXP

Bulletin has no description...

CVE-2026-75014

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-12553

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-17639 Certain HP Smart Tank All in One – Potential Denial of Service

Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests...

CVE-2026-17639

HP Smart Tank All-in-One printers are vulnerable to denial of service via concurrent HTTP requests; no specific models or patch versions are provided. CVSS 4.0 scores MEDIUM (6.9). Exploitation status is not reported. See HP advisory HPSBPI04142 for details. Monitor for vendor updates. No exploit...

CVE-2026-17639

Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests...

GHSA-2QJ4-MMR9-4V2F

creationtimestamp| type| source ---|---|--- 2026-08-17 18:31:27+00:00| seen| https://gist.github.com/alon710/3510ab254b4d34227fef740b05b4af4e...

CVE-2026-73424

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...