CVE-2024-9506 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

GHSA-7MX3-VVMW-HJMV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, langfuse-fips, langfuse, commercial-gitlab-rails-ee-fips, commercial-gitlab-rails-ee...

GHSA-86W9-CPQP-85RV vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

GHSA-C8X8-7FP4-3X9W vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

GHSA-G3CH-RX76-35FX vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

CVE-2026-104847 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

GHSA-6FW5-9HQ8-W87G vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

EUVD-2026-94831

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

CVE-2026-104704

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a flaw where the server fails to enforce TLS for outbound SMTP delivery when DNSSEC-validated TLSA records lack a DANE-EE (usage 3) record. Instead of strictly adhering to RFC 7672, the server treats certain unusable rec...

CVE-2026-104704: Cleartext Transmission of Sensitive Information

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...

BIT-GITLAB-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

Review.CVE-2023-5612

CVE-2023-5612 – SSRF di GitLab tramite URL Webhook PoC e Analisi 📌 Panoramica CVE ID CVE: CVE-2023-5612 Gravità: Alta CVSS: 8.1 Punteggio Base Tipo: Server-Side Request Forgery SSRF Componente: Webhook di GitLab CE/EE Versioni Affette: GitLab CE/EE " \ --data-urlencode "url=http://127.0.0.1:8888"...

com.vaadin:vaadin (>=25.2.0-beta1, <=25.2.6), com.vaadin:vaadin-ee (>=25.2.2, <=25.2.6) potentially affected by CVE-2026-93547 via com.vaadin:vaadin-spreadsheet-flow (>=25.2.0-beta1, <=25.2.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =25.2.0-beta1, =25.2.0-beta1, =25.2.2, =25.2.6 Source cves: CVE-2026-93547 Source advisory: SNYK:JAVA-COMVAADIN-20511645...

CVE-2026-84739

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-10518

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

EUVD-2026-88690

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

EUVD-2026-88688

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...