CVE-2026-79708: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-55374

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-13210

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-13210

GitLab CE/EE is affected by an improper input validation flaw in the environment scope pattern matcher for CI/CD variables. An authenticated user could access CI/CD variables outside their intended environment scope under certain conditions. The issue affects versions from 15.7 before 19.1.8 , 19...

CVE-2026-13210 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

EUVD-2026-78908

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-13210 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-55374 canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...

CVE-2026-57135 PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv only to inject invalid httpproxy and httpsproxy environment variables and does not establish an operating-system network...

kernel: net: qrtr: restrict socket creation to the initial network namespace

A flaw was found in the Linux kernel's QRTR Qualcomm IPC Router networking component. An unprivileged local attacker can create a QRTR socket in a separate network namespace. Due to improper handling of global state variables, this allows the attacker to send datagrams and control-plane messages ...

EUVD-2026-78168

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-13210: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input...

ROS-20260915-73-0130

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created HTML page...

PT-2026-92164

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.7 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where improper input validation in the environment scope pattern matcher could allow an...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-68489

A flaw was found in Plesk extensions Ruby and Node.js Toolkit. This static code injection vulnerability allows remote authenticated users to execute arbitrary code as root. The flaw is triggered by manipulating custom environment variables, leading to a complete compromise of the affected system...

CVE-2026-68489

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

EUVD-2026-78137

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables...

CVE-2026-68489

CVE-2026-68489 is a Static Code Injection vulnerability in two Plesk extensions: Ruby (before 1.6.6) and Node.js Toolkit (before 2.5.0). A remote authenticated user can execute arbitrary code as root by crafting malicious custom environment variables . The vulnerability scores 8.7 (HIGH) under CV...