EUVD-2026-57437

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

CVE-2026-15216

GitLab CVE-2026-15216 affects GitLab CE/EE prior to patched versions: 19.0.6 (for 18.2 line), 19.1.4 (for 19.1 line), and 19.2.2 (for 19.2 line). The issue arises from improper neutralization of user-controlled data rendered in pagination controls within an analytics dashboard component, enabling...

CVE-2026-15216 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by...

CVE-2026-19228 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information...

PT-2026-71214

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where improper neutralization of user-controlled data rendered in pagination controls by ...

GitLab 18.2 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15217)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site...

PT-2026-71215

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description An issue exists where an analytics dashboard component fails to properly neutralize user-controlled value...

CVE-2026-58650

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-58650

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

EUVD-2026-56289

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-58650

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

Visual Studio Code Security Feature Bypass Vulnerability

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

PT-2026-71960

Name of the Vulnerable Software and Affected Versions OutSystems Service Center versions prior to 11.41.2 OutSystems Lifetime versions prior to 11.28.2.3955 Description OutSystems Service Center is subject to a DOM-based Cross-Site Scripting XSS issue, where a low-privileged attacker can execute...

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...

CVE-2026-19433

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

CVE-2026-19433

CVE-2026-19433 affects the Roskus Prospero Flow CRM contact management component (pre-5.4.8). The root cause is that save and export operations retrieve the contact record without constraining the query to the authenticated user’s company, enabling an authenticated user from any company to overwr...

CVE-2026-19433 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

EUVD-2026-55634

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

CVE-2026-19433 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

EUVD-2026-55234

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...