48 matches found
CVE-2026-61559
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...
CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...
CVE-2026-61559 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...
CVE-2026-61559
@zereight/mcp-gitlab (a Model Context Protocol server for GitLab) is vulnerable to Server-Side Request Forgery in versions 0.0.1 through
EUVD-2026-80004
@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...
GHSA-2H44-8472-FRJJ @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...
CVE-2026-84664
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...
CVE-2026-84664
Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...
CVE-2026-7250
GitLab CVE-2026-7250 affects GitLab CE/EE: versions 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 could, under certain conditions, allow an unauthenticated user to cause a denial of service due to improper input validation in the API request parsing middleware. Root cause is ...
CVE-2023-31485
GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks...
CVE-2021-22224
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim...
CVE-2025-10282
BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL...
BBOT 安全漏洞
BBOT is a recursive Internet scanner open-sourced by Black Lantern Security. BBOT suffers from a security vulnerability that stems from a maliciously formatted git URL that could lead to the disclosure of GitLab API keys to an attacker-controlled server...
EUVD-2020-5584
Malware in sbrugna...
EUVD-2021-26244
Malware in sbrugna...
EUVD-2020-5611
Malware in sbrugna...
EUVD-2014-8377
Malware in sbrugna...