PT-2026-71198

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description Improper authorization in pipeline reference validation allows an authenticated user with developer-role...

PT-2026-71137

Name of the Vulnerable Software and Affected Versions binutils affected versions not specified Description Multiple Use-After-Free issues exist in the add archive element function within the GNU linker ld, a component of binutils. The problem occurs when plugin maybe claim in ld/plugin.c frees th...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE GitLab Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE Authorizatio...

GHSA-3GMF-P6R4-Q8M6

creationtimestamp| type| source ---|---|--- 2026-08-11 09:43:37+00:00| seen| https://gist.github.com/hayageek/05ef86a8272d03ab9e54ab5476cf7afe...

Malicious code in @nebula.js/sn-tabbed-container (npm)

npm/@nebula.js/sn-tabbed-container is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in picasso.js (npm)

npm/picasso.js is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...

MAL-2026-11709 Malicious code in @or-sdk/library-types-v1 (npm)

npm/@or-sdk/library-types-v1 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11629 Malicious code in @onereach/si-alert (npm)

npm/@onereach/si-alert is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @or-sdk/event-manager (npm)

npm/@or-sdk/event-manager is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11700 Malicious code in @or-sdk/idw-public (npm)

npm/@or-sdk/idw-public is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11724 Malicious code in @or-sdk/sdk-api (npm)

npm/@or-sdk/sdk-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

GitLab 18.0 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-12436)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

CVE-2026-12436

GitLab CE/EE is affected by CVE-2026-12436 in versions 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. The issue arises from improper validation of user-supplied attributes when processing pipeline schedule inputs, potentially allowing an authenticated user to modify another user’...

EUVD-2026-50482

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436: Improperly Controlled Modification of Dynamically-Determined Object Attributes

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

GHSA-XG2H-5XR2-29JW Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...

CVE-2026-0934

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configuratio...

CVE-2026-0934 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configuratio...