vexhub-crawler

VEX Hub Crawler vexhub-crawler is a component of the VEX Hub that automatically retrieves VEX documents from source repositories. Overview The crawler identifies source repositories from registered PURLs Package URLs and copies VEX documents into VEX Hub. This process ensures that VEX Hub maintai...

CVE-2026-10053-lab

CVE-2026-10053 — laboratório de verificação reproduzível Laboratório autocontido que prova o path traversal do registro de pacotes npm do GitLab CVE-2026-10053 e mostra que está corrigido, usando um oráculo determinístico em disco — não o status HTTP. O que é e o que não é provado. Este laboratór...

deptrust

deptrust root@kitploit: / / / / / / / / / / / / / / / / / / / // / / // / / // / ,// ./// ,/// // deptrust è un'interfaccia a riga di comando che controlla le versioni dei pacchetti per vulnerabilità note su npm, PyPI, crates.io, moduli Go, RubyGems, NuGet, Maven, Packagist, pub.dev,...

CVE-2026-10053

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053

GitLab CE/EE is affected by a path traversal vulnerability in the package registry component that could allow an authenticated user (low privileges) to achieve remote code execution . The vulnerability affects versions 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The CVSS 3.1 s...

EUVD-2026-64645

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

GitLab 18.8 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-10053)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an...

PT-2026-79764

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3control-fips, crossplane-provider-aws-route53, crossplane-provider-aws-elasticbeanstalk, crossplane-provider-azure-securityinsights, crossplane-provider-azure-portal, crossplane-provider-aws-ce-fips, crossplane-provider-aws-dataexchange,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: bank-vaults-fips, cosign, aactl, vexctl, falcoctl-fips, cloudflared, fulcio, terragrunt, spire-server-fips, sops, tekton-chains, flux-kustomize-controller, flux-source-controller, gitsign, fulcio-fips, tkn, dex, argo-workflows, slsa-verifier, spire-server, kots,...

GO-2026-4980 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, crossplane-provider-aws-s3control-fips, kubernetes-dashboard-fips, amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-securityinsights, crossplane-provider-azure-portal, grype-fips, terraform-docs-fips,...

CVE-2026-73415 vulnerabilities

Vulnerabilities for packages: tensorflow-cpu-jupyter...

CVE-2026-8667

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

EUVD-2026-57395

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

CVE-2026-8667

GitLab CE/EE contains an authorization-level issue: under certain conditions an authenticated user with the developer role could modify package registry metadata without maintainer permissions. Affected versions: 17.6 up to 19.0.5, 19.1 up to 19.1.3, and 19.2 up to 19.2.1. Remediation patches rel...

CVE-2026-8667 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

CVE-2026-8667 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

MAL-2026-11786 Malicious code in @qlik/carboncopy (npm)

npm/@qlik/carboncopy is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...