PT-2026-102476

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.2.6 GitLab CE/EE versions 19.3 through 19.3.2 GitLab CE/EE versions 19.4 through 19.4.0 Description An authenticated user can read private child issue contents, such as titles and descriptions, from projec...

CVE-2026-8937: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects...

PT-2026-102622

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-97395: Undefined Security Weakness

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

PT-2026-102879

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to netwo...

PT-2026-102736

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for...

PT-2026-102612

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

PT-2026-102807

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.63.1 Description The client read authenticated function in russh/src/client/encrypted.rs forwards several channel subtypes—including CHANNEL DATA, CHANNEL EXTENDED DATA, CHANNEL EOF, CHANNEL CLOSE, CHANNEL OPEN FAILUR...

CVE-2026-102830: Improper Neutralization of Input During Web Page Generation

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

FreeBSD: VID-3f11e437-b7cd-11f1-a883-2cf05da270f3 (CVE-2026-84739): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

PT-2026-102952

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description An improper authorization issue exists in the Access Portal reverse proxy. This allows an authenticated user with low privileges to access unauthorized web applications by sending a...

PT-2026-102463

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

PT-2026-102740

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

PT-2026-102797

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper validation of an attacker-controlled file path allows a local authenticated attacker to change the ownership of arbitrary files. Recommendations At the moment, there is no information about a...

PT-2026-102739

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due ...

Linux Distros Unpatched Vulnerability : CVE-2026-53627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update...

GitLab 19.0 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-8937)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-55217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low- privileged authenticated user can create, update, or delete...

CVE-2026-102630: Use of Less Trusted Source

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...