22481 matches found
CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...
CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...
CVE-2026-16049
The Mattermost GitLab plugin (versions ≤11.8, 10.20.11, 11.5.7.0) fails to verify channel permissions for caller-supplied post_id and does not validate the web_url parameter against the configured GitLab instance. Through the createIssue and attachCommentToIssue API endpoints, an authenticated at...
CVE-2026-16049
Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...
BIT-GITLAB-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...
PT-2026-76769
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.11.10 GitLab CE/EE versions 19.0 through 19.0.7 GitLab CE/EE versions 19.1 through 19.1.5 GitLab CE/EE versions 19.2 through 19.2.3 Description Improper request validation in GraphQL multiplex query handli...
Gitlab -- Vulnerabilities
Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE...
PT-2026-76671
Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied post id , and fails to validate the web url parameter against the configured GitLab instance, which allows an authenticated...
PT-2026-76768
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.11.10 GitLab CE/EE versions 19.0 through 19.0.7 GitLab CE/EE versions 19.1 through 19.1.5 GitLab CE/EE versions 19.2 through 19.2.3 Description An unauthenticated remote attacker can modify or delete publi...
GO-2026-5032 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, mattermost-fips, seaweedfs-rocksdb, gitlab-workhorse-ce, seaweedfs, seaweedfs-fips, seaweedfs-rocksdb-fips, seaweedfs-operator...
GO-2026-5031 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, mattermost-fips, seaweedfs-rocksdb, gitlab-workhorse-ce, seaweedfs, seaweedfs-fips, seaweedfs-rocksdb-fips, seaweedfs-operator...
GO-2026-5066 vulnerabilities
Vulnerabilities for packages: hugo, seaweedfs-operator, seaweedfs-operator-fips, mattermost-fips, rclone, listmonk, gitlab-workhorse-ce, rclone-fips, seaweedfs-fips, seaweedfs, mattermost...
GO-2024-2576 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...
GO-2026-5024 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, trino, etcd-fips, kubeflow-katib, upwind-agent, k3s, kube-conformance, etcd...
GO-2026-5062 vulnerabilities
Vulnerabilities for packages: hugo, mailpit, seaweedfs-operator, seaweedfs-operator-fips, hugo-extended, mattermost-fips, hugo-fips, rclone, seaweedfs-rocksdb, gitlab-workhorse-ce, listmonk, filebrowser, rclone-fips, seaweedfs-fips, mailpit-fips, seaweedfs-rocksdb-fips, seaweedfs, mattermost...
GO-2026-6006 vulnerabilities
Vulnerabilities for packages: gitlab-operator, gitlab-operator-fips, datadog-agent-fips, tigera-operator-fips, tigera-operator, datadog-agent...
GO-2026-6003 vulnerabilities
Vulnerabilities for packages: gitlab-operator, gitlab-operator-fips, datadog-agent-fips, tigera-operator-fips, tigera-operator, datadog-agent...
GO-2026-6005 vulnerabilities
Vulnerabilities for packages: gitlab-operator, gitlab-operator-fips, datadog-agent-fips, tigera-operator-fips, tigera-operator, datadog-agent...