CVE-2026-77801

GitLab CE/EE versions from 12.8 before 19.1.7 , 19.2 before 19.2.5 , and 19.3 before 19.3.1 are affected by an Allocation of Resources Without Limits or Throttling issue. The root cause is missing object count limits in background job processing , which under certain conditions could allow an aut...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

EUVD-2026-66427

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-77658

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...

WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

CVE-2026-77658 Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs. The original incident was first reported by...

CVE-2026-77611: Incorrect Authorization

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler...

CVE-2026-3235: Authorization Bypass Through User-Controlled Key

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-80428: Deserialization of Untrusted Data

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

PT-2026-82103

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.8 through 19.1.6 GitLab CE/EE versions 19.2 through 19.2.4 GitLab CE/EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user can cause a denial of service affecting background job...

CVE-2026-77801: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

PT-2026-82296

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description Several endpoints perform object lookups using a global scope instead of restricting the search to projects the user is authorized to access. Consequently, the system returns an HTTP 403 Forbidden...

Linux Distros Unpatched Vulnerability : CVE-2026-79781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in ...

GitLab 12.8 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-77801)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an...