The vulnerability of the CI/CD Harden-Runner security agent, related to incorrect privilege assignment, allows a perpetrator to elevate their privileges.

The vulnerability of the security agent CI/CD Harden-Runner is related to the improper assignment of privileges. Exploiting this vulnerability can allow a attacker to enhance their privileges...

CVE-2025-11246

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner...

CVE-2025-11246 Insufficient Granularity of Access Control in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner...

CVE-2025-11246: Insufficient Granularity of Access Control

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user with specific permissions to remove all project runners from unrelated projects by manipulating GraphQL runner...

The vulnerability of the java-plugin-runner plugin for the Apache APISIX cloud API allows a hacker to escalate their privileges.

The vulnerability of the java-plugin-runner plugin of the Apache APISIX cloud API gateway is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2024-2874

An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources...

CVE-2024-12303 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-1477 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-2937 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-6186 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-7734 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-4VC6-9M66-J82C vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-CXXF-6583-J227 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-H6QJ-3XRQ-VXH8 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-QFPG-MW2P-44HG vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-WXX2-2CV7-VHX6 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

GHSA-VP64-6MXR-66QC vulnerabilities

Vulnerabilities for packages: gitlab-runner...

CVE-2025-2614 vulnerabilities

Vulnerabilities for packages: gitlab-runner...

Gitlab -- vulnerabilities

Gitlab reports: Stored Cross-site Scripting issue in GitLab Flavored Markdown placeholders impacts GitLab CE/EE Cross-site Scripting issue in Web IDE impacts GitLab CE/EE Missing Authorization issue in Duo Workflows API impacts GitLab EE Missing Authorization issue in AI GraphQL mutation impacts...

GHSA-62R4-HW23-CC8V n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

Impact A sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process...