GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: redpanda-console, mapotf, nri-mssql, kubernetes-dashboard-api, keda-http-add-on, timestamp-authority-fips, cluster-api-azure-controller-fips, frankenphp-8.2, k8sgateway-fips, virt-controller, bank-vaults, neuvector, kcp, nats-top-fips, knative-kafka-broker,...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

GO-2026-5486 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, tekton-chains, tkn-fips, tkn, tekton-pipelines, tekton-chains-fips...

GO-2026-4678 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips...

GO-2025-3720 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, argo-cd, argocd-image-updater-fips...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: telegraf, apko-fips, cadvisor-fips, falcoctl-fips, docker-cli-buildx, k9s-fips, zarf, kargo, zot, apko, trufflehog, opentelemetry-collector-fips, dagger, buildkitd-fips, spire-server-fips, aws-otel-collector-fips, falcoctl, trufflehog-fips, grype-fips, goreleaser,...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: aactl, apko, ko...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, tempo, kargo, amazon-cloudwatch-agent, nats, kine, argo-cd, argo-workflows, jaeger, argo-rollouts, datadog-agent, verticadb-operator, kubeflow-pipelines, k3s, aws-otel-collector, k8sgateway, opentelemetry-collector-contrib, k8sgpt, vale,...

GHSA-P28V-F755-9QRG

creationtimestamp| type| source ---|---|--- 2026-08-13 21:32:39+00:00| seen| https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

Vulnerabilities managed in GitLab Enterprise Edition and Community Edition

GitLab has identified several vulnerabilities in its GitLab Enterprise Edition and Community Edition versions, ranging from 12.0 to 19.2.2. These vulnerabilities concern various aspects of GitLab, including incorrect privilege allocation, where users with pending membership statuses inadvertently...

CVE-2026-15423

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

EUVD-2026-57393

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423

GitLab CE/EE (all supported branches) were vulnerable to an authorization flaw in pipeline reference validation that could let an authenticated user with developer-role permissions run CI/CD pipelines on a protected branch without requiring push permissions. Affected versions: 19.0 before 19.0.6,...