CVE-2026-105640

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

EUVD-2026-92596

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-105640: Improper Authentication

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set ...

CVE-2026-10078 Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to th...

CVE-2026-10078

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to th...

PT-2026-44797

Name of the Vulnerable Software and Affected Versions Quay config-tool affected versions not specified Description A flaw in the GitLab OAuth validator causes sensitive credentials, specifically client id and client secret, to be transmitted as plaintext in URL query parameters during POST reques...

CVE-2026-10078: Use of GET Request Method With Sensitive Query Strings

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically clientid and clientsecret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to th...

CVE-2026-42195 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...

EUVD-2019-2157

Malware in sbrugna...

EUVD-2024-27140

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2018-19574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth...

Linux Distros Unpatched Vulnerability : CVE-2020-13312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a...

CSRF vulnerability in gitlab-oauth

gitlab-oauth 1.17.1 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker's account. gitlab-oauth 1.18 implements a state...

br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), org.jenkins-ci.plugins:gitlab-oauth (>=1.0.3, <=1.0.9) +1 more potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (2.4.4)

org.jenkins-ci.plugins:git MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - br.com.ingenieux.jenkins.plugins:codecommit-url-helper 0.0.1 - org.jenkins-ci.plugins:gitlab-oauth =1.0.3,...

br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), org.jenkins-ci.plugins:gitlab-oauth (>=1.0.3, <=1.0.9) +1 more potentially affected by CVE-2021-21684 via org.jenkins-ci.plugins:git (2.4.4)

org.jenkins-ci.plugins:git MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - br.com.ingenieux.jenkins.plugins:codecommit-url-helper 0.0.1 - org.jenkins-ci.plugins:gitlab-oauth =1.0.3,...

br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), org.jenkins-ci.plugins:gitlab-oauth (>=1.0.3, <=1.0.9) +1 more potentially affected by CVE-2020-2136 via org.jenkins-ci.plugins:git (2.4.4)

org.jenkins-ci.plugins:git MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - br.com.ingenieux.jenkins.plugins:codecommit-url-helper 0.0.1 - org.jenkins-ci.plugins:gitlab-oauth =1.0.3,...

br.com.ingenieux.jenkins.plugins:codecommit-url-helper (0.0.1), org.jenkins-ci.plugins:gitlab-oauth (>=1.0.3, <=1.0.9) +1 more potentially affected by CVE-2022-30947 via org.jenkins-ci.plugins:git (2.4.4)

org.jenkins-ci.plugins:git MAVEN version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - br.com.ingenieux.jenkins.plugins:codecommit-url-helper 0.0.1 - org.jenkins-ci.plugins:gitlab-oauth =1.0.3,...

Client Secret stored in plain text by gitlab-oauth

gitlab-oauth 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration. This client secret can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is...

Open redirect vulnerability in gitlab-oauth

gitlab-oauth 1.13 and earlier records the HTTP Referer header as part of the URL query parameters when the authentication process starts and redirects users to that URL when the user has finished logging in. This allows attackers with access to Jenkins to craft a URL that will redirect users to a...

Improper authorization of users and groups with the same base name in gitlab-oauth

gitlab-oauth 1.5 and earlier does not differentiate between user names and hierarchical group names when performing authorization. This allows an attacker with permissions to create groups in GitLab to gain the privileges granted to another user or group. gitlab-oauth 1.6 performs user name and...