GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, flux-fips, chisel, knative-eventing-fips, zitadel, fscrypt, mattermost, rancher-agent, frankenphp-8.2, grafana, commercial-expanso-edge, reports-server, calico-fips, drone-fips, falco-no-driver, external-dns, gitlab-rails-ce, k3s,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, flux-fips, chisel, knative-eventing-fips, zitadel, fscrypt, mattermost, rancher-agent, frankenphp-8.2, grafana, commercial-expanso-edge, reports-server, calico-fips, drone-fips, falco-no-driver, external-dns, gitlab-rails-ce, k3s,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, knative-eventing-fips, zitadel, fscrypt, mattermost, rancher-agent, frankenphp-8.2, teleport-operator-fips, grafana, commercial-expanso-edge, reports-server, calico-fips, falco-no-driver, external-dns, gitlab-rails-ce, k3s, elastic-agent-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, flux-fips, gptscript, chisel, knative-eventing-fips, zitadel, datadog-agent-fips, fscrypt, mattermost, rancher-agent, frankenphp-8.2, teleport-operator-fips, grafana, juicefs, commercial-expanso-edge, reports-server, calico-fips, drone-fips,...

CVE-2026-5796 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the...

CVE-2026-8330

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI/CD API endpoint...

CVE-2026-5952: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite...

CVE-2024-1485 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-54297 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby3.3-faraday, cinc-auditor, logstash, kube-logging-operator, logstash-fips, kube-fluentd-operator, gitlab-rails-ce, gitlab-cng...

GHSA-98M9-HRRM-R99R vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, ruby3.3-faraday, cinc-auditor, logstash, kube-logging-operator, logstash-fips, kube-fluentd-operator, gitlab-rails-ce, gitlab-cng...

Fedora 43 : singularity-ce (2026-5358fb95a0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5358fb95a0 advisory. Upgrade to 4.4.2 upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Fedora 44 : singularity-ce (2026-63ae478575)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-63ae478575 advisory. Upgrade to 4.4.2 upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

CVE-2026-10850

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

EUVD-2026-37732

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

CVE-2026-10850: Improper Neutralization of Input During Web Page Generation

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

Linux Distros Unpatched Vulnerability : CVE-2026-9204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain...

CVE-2026-10733

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

CVE-2026-1500 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to cause denial of service due to uncontrolled resource consumption when processing ...

CVE-2026-3553

GitLab CE/EE was vulnerable to an incorrect authorization check that could allow an authenticated user to view confidential issue details. Affected versions were all 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2. The issue has been remediated in patch releases: GitLab 18.10.8,...

CVE-2026-3553 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to access confidential issue details due to incorrect authorization checks...