GHSA-HM49-WCQC-G2XG vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, kube-fluentd-operator, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

CVE-2026-42246 vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, kube-fluentd-operator, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

CVE-2026-42256 vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

GHSA-87PF-FPWV-P7M7 vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

CVE-2026-42245 vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, kube-fluentd-operator, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

CVE-2026-42257 vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, kube-fluentd-operator, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

CVE-2026-42258 vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, kube-fluentd-operator, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

GHSA-VCGP-9326-PQCP vulnerabilities

Vulnerabilities for packages: ruby4.0-net-imap, gitlab-rails-ce, gitlab-rails-ce-fips, ruby3.2-rails, ruby3.3-net-imap, jruby, kube-logging-operator, ruby3.4-net-imap, truffleruby, kube-fluentd-operator, logstash-fips, ruby3.4-rails, logstash, ruby3.2-net-imap, ruby3.3-rails, ruby4.0-rails...

CVE-2026-7179

A flaw was found in the WinCE Extraction Plugin of OSPG binwalk. A local attacker can exploit this vulnerability by manipulating the 'self.filename' argument in the 'readnullterminatedstring' function. This manipulation leads to a path traversal vulnerability, potentially allowing the attacker to...

EUVD-2026-25932

A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function readnullterminatedstring of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.filename leads to path traversa...

CVE-2026-7179

A security vulnerability has been detected in OSPG binwalk up to 2.4.3. This vulnerability affects the function readnullterminatedstring of the file src/binwalk/plugins/winceextract.py of the component WinCE Extraction Plugin. Such manipulation of the argument self.filename leads to path traversa...

EUVD-2026-25048

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions...

CVE-2025-0186 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests...

CVE-2025-9957 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to...

CVE-2026-5816 Improper Resolution of Path Equivalence in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions...

📄 Dovecot IMAP NOOP Command Memory Exhaustion Denial of Service

This Metasploit auxiliary module targets a memory exhaustion vulnerability in the Dovecot IMAP service. It opens multiple concurrent TCP connections and sends specially crafted NOOP commands containing deeply nested parentheses to force excessive memory allocation on the server. By sustaining the...

BIT-GITLAB-2026-2104 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: nri-nagios-fips, timestamp-authority-fips, consul-k8s, zabbix-agent2, gostatsd, gomplate, kyverno-policy-reporter-plugins-trivy-fips, external-secrets-operator-fips, docker-credential-gcr-fips, helm-mapkubeapis, yq, crossplane-provider-aws-cognitoidp, q,...

CVE-2026-2104 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks...

CVE-2026-22500

Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through = 1.1.2...