GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, minio, gitlab-kas, step-issuer, flux-image-automation-controller, argo-events, external-dns, argo-cd, opentelemetry-collector, guac, fscrypt, melange, spire-server, dagger, buildah, scorecard, docker-machine-driver-harvester,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, pulumi-kubernetes-operator, minio, docker-machine-driver-linode, crossplane-provider-aws-route53, gitlab-kas, step-issuer, flux-image-automation-controller, terraform-provider-acme, sops, terraform-provider-azurerm,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: podman, aactl, cert-manager, minio, telegraf, gitlab-kas, prometheus-operator, kyverno, kubernetes, cilium, nerdctl, rancher, snyk-cli, external-dns, kots, opentelemetry-collector, helm, containerd, k3s, istio, fscrypt, external-secrets-operator, mattermost,...

GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd...

GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd...

CVE-2026-0934

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configuratio...

CVE-2026-0934 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configuratio...

CVE-2026-0934 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configuratio...

CVE-2026-8330 Insertion of Sensitive Information into Log File in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI/CD API endpoint...

GitLab 9.3 < 18.11.6 / 19.0 < 19.0.3 / 19.1 < 19.1.1 (CVE-2026-8330)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive...

Security Bulletin: IBM MQ Appliance is affected by an information exposure vulnerability (CVE-2026-40895)

Summary IBM MQ Appliance has addressed an information exposure vulnerability. Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP reque...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, gitlab-runner-fips, crossplane-provider-aws-rolesanywhere, crossplane-provider-aws-iam-fips, gitness, peerdb-flow, argo-rollouts-fips, policy-controller-fips, knative-client, vault-fips, conftest, crossplane-provider-aws-sqs-fips,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-athena, gitlab-runner-fips, crossplane-provider-aws-rolesanywhere, crossplane-provider-aws-iam-fips, gitness, peerdb-flow, argo-rollouts-fips, policy-controller-fips, knative-client, vault-fips, conftest, crossplane-provider-aws-sqs-fips,...

CVE-2026-56378

A vulnerability in ImageMagick allows attackers to crash the application or expose system data if a maliciously crafted Picture CD PCD file is processed. Mitigation Avoid processing untrusted PCD Picture CD image files with ImageMagick. Applications that utilize ImageMagick for image processing...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the handleReq function. An attacker can inject unauthorized webhook payloads by sending requests that bypass the intended authentication mechanism, introducing fake CI/CD trace data into the observability...

BIT-GITLAB-2026-10733 Improper Restriction of Rendered UI Layers or Frames in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

Directory Traversal

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Directory Traversal via the filtersafetarinfos and filtersafezipinfos functions in the archive extraction utilities. An attacker can write arbitrary files outside the...

CVE-2026-10733

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

CVE-2026-10733 Improper Restriction of Rendered UI Layers or Frames in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

CVE-2026-10733 Improper Restriction of Rendered UI Layers or Frames in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...