PT-2026-69056

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x Description An incorrect authorization issue exists in the repository-creation user interface. A user account with delegated repository-admin privileges for a specific repository format c...

geonode (4.4.5), mayan-edms (>=4.6.13, <=4.7.9) +4 more potentially affected by CVE-2026-15307 via django (4.2.29)

django PYPI version 4.2.29 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - geonode 4.4.5 - mayan-edms =4.6.13, =7.4.0, =7.4.0, =4.0.17, =4.0.18 - pheme 21.12.1 Source cves: CVE-2026-15307 Source advisory:...

geonode (4.4.5), mayan-edms (>=4.6.13, <=4.7.9) +4 more potentially affected by CVE-2026-15830 via django (4.2.29)

django PYPI version 4.2.29 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - geonode 4.4.5 - mayan-edms =4.6.13, =7.4.0, =7.4.0, =4.0.17, =4.0.18 - pheme 21.12.1 Source cves: CVE-2026-15830 Source advisory:...

crate-anon (0.20.8), mayan-edms (4.10.4) +4 more potentially affected by CVE-2026-15307 via django (4.2.28)

django PYPI version 4.2.28 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - crate-anon 0.20.8 - mayan-edms 4.10.4 - nemo =7.3.5, =7.3.9, =4.0.6, =21.11.3, =21.12.0 Source cves: CVE-2026-15307 Source advisory:...

geonode (4.4.5), mayan-edms (>=4.6.13, <=4.7.9) +4 more potentially affected by CVE-2026-15830 via django (4.2.29)

django PYPI version 4.2.29 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - geonode 4.4.5 - mayan-edms =4.6.13, =7.4.0, =7.4.0, =4.0.17, =4.0.18 - pheme 21.12.1 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-37...

CVE-2025-14562 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

CVE-2026-14341 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

GHSA-86R3-Q889-HVG2 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

GHSA-G9G2-QC64-JGCJ vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

CVE-2026-4672 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

CVE-2026-6336 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

GHSA-94P8-87FF-W336 vulnerabilities

Vulnerabilities for packages: gitlab-cng, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, gitlab-rails-ce, gitlab-runner, gitlab-cng-fips, gitlab-runner-fips, gitlab-rails-ce-fips...

GHSA-XR9X-R78C-5HRM vulnerabilities

Vulnerabilities for packages: pghero-fips, pghero, gitlab-rails-ce, ruby3.3-rails, gitlab-rails-ce-fips...

CVE-2026-66066 vulnerabilities

Vulnerabilities for packages: pghero-fips, pghero, gitlab-rails-ce, ruby3.3-rails, gitlab-rails-ce-fips...

CVE-2026-54603 vulnerabilities

Vulnerabilities for packages: ruby3.3-oauth2, ruby3.4-oauth2, ruby4.0-oauth2, gitlab-rails-ce, ruby3.2-oauth2, gitlab-rails-ce-fips...

CVE-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-12436: Improperly Controlled Modification of Dynamically-Determined Object Attributes

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2025-14562: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a...

CVE-2026-6267: Insertion of Sensitive Information Into Sent Data

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-15975: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing...