GHSA-JXRP-R7GX-Q4J8 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, nextcloud-server, tensorflow-gpu-jupyter, kibana, gitlab-rails-ce, awx, opensearch-dashboards, wazuh-dashboard-fips, jupyter-base-notebook, gitlab-rails-ce-fips, librechat, wazuh-dashboard, langfuse, langfuse-fips...

CVE-2026-66010 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, nextcloud-server, tensorflow-gpu-jupyter, kibana, gitlab-rails-ce, awx, opensearch-dashboards, wazuh-dashboard-fips, jupyter-base-notebook, gitlab-rails-ce-fips, librechat, wazuh-dashboard, langfuse, langfuse-fips...

GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own...

CVE-2026-90970

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

EUVD-2026-91651

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

CVE-2026-90970

GitLab has remediated a critical vulnerability in the GitLab AI Gateway component (CWE-1336) affecting versions 18.1.6 before 19.2.4 , 19.3 before 19.3.2 , and 19.4 before 19.4.1 . An authenticated user with Duo Agent Platform access could exploit a template engine weakness to escape the prompt t...

GHSA-P98J-92PF-MC4P vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, commercial-gitlab-rails-ee, nextcloud-server, gitlab-rails-ce, awx, opensearch-dashboards, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, librechat, wazuh-dashboard, langfuse, langfuse-fips...

CVE-2026-90970: Improper Neutralization of Special Elements Used in a Template Engine

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape...

PT-2026-104355

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 19.2.3 GitLab AI Gateway versions 19.3 through 19.3.1 GitLab AI Gateway versions 19.4 through 19.4.0 Description An improper neutralization weakness in the custom-flow prompt-template processing of the...

GHSA-2GC4-CQFQ-P2GV vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, redisinsight, jupyter-base-notebook, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

CVE-2026-102599 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, gitlab-rails-ce, redisinsight, jupyter-base-notebook, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips...

CLEANSTART-2025-WF62094 Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3

Security vulnerability affects the gitlab-runner package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-100689 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-100689 Source advisory: OSV:GHSA-59CR-6R3X-644W...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-100689 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-100689 Source advisory: OSV:GHSA-59CR-6R3X-644W...

dotcli (>=0.1.4, <=0.1.7), giraumon (0.0.1) +3 more potentially affected by CVE-2026-87819 via gitpython (2.1.5)

gitpython PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dotcli =0.1.4, =1.0.1, =1.0.0, =1.0.18 Source cves: CVE-2026-87819 Source advisory: OSV:GHSA-G5VV-9GXW-82HX...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-87819 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-87819 Source advisory: OSV:GHSA-G5VV-9GXW-82HX...

elemeno-ai-sdk (>=0.0.5, <=0.0.20), foresthog (>=0.9.0, <=1.3.6) +7 more potentially affected by CVE-2026-87819 via gitpython (2.1.1)

gitpython PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elemeno-ai-sdk =0.0.5, =0.9.0, =0.1.0, =0.4.0, =0.0.5, =0.0.1, =1.0.0, =1.0.4, =1.0.10 Source cves: CVE-2026-87819 Source advisory:...