PT-2026-73291

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, kubernetes-dashboard-auth-fips, seaweedfs-rocksdb-fips, flux, aws-efs-csi-driver-fips, kubernetes-csi-external-snapshotter, crossplane-provider-aws-ec2, loki-fips, cloud-provider-aws, cert-exporter-fips, longhorn-share-manager-fips,...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

GO-2026-5486 vulnerabilities

Vulnerabilities for packages: tekton-chains, tkn-fips, tekton-chains-fips, tkn, tekton-pipelines-fips, tekton-pipelines...

GO-2026-4678 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, argo-workflows, kubeflow-pipelines...

GO-2025-3720 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater, argo-cd...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: apko, elastic-agent, k9s, openfga, syft-fips, beats-fips, prometheus, openfga-fips, prometheus-fips, trufflehog-fips, buildah, splunk-otel-collector, chainctl, nerdctl-fips, opentelemetry-collector-fips, splunk-otel-collector-fips, falcoctl, zot,...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: apko, aactl, ko...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: verticadb-operator, argo-cd, argo-workflows, k8sgateway, kubeflow-pipelines, grafana-alloy, jaeger, k8sgpt, coredns, opentelemetry-collector-contrib, kargo, vale, k3s, splunk-otel-collector, argo-rollouts, datadog-agent, kserve, kine, amazon-cloudwatch-agent, nats,...

GHSA-P28V-F755-9QRG

creationtimestamp| type| source ---|---|--- 2026-08-13 21:32:39+00:00| seen| https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

Vulnerabilities managed in GitLab Enterprise Edition and Community Edition

GitLab has identified several vulnerabilities in its GitLab Enterprise Edition and Community Edition versions, ranging from 12.0 to 19.2.2. These vulnerabilities concern various aspects of GitLab, including incorrect privilege allocation, where users with pending membership statuses inadvertently...

CVE-2026-15423

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423

GitLab CE/EE (all supported branches) were vulnerable to an authorization flaw in pipeline reference validation that could let an authenticated user with developer-role permissions run CI/CD pipelines on a protected branch without requiring push permissions. Affected versions: 19.0 before 19.0.6,...

EUVD-2026-57393

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-15423: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...