#gitlab
-
CISA Adds Exploited GitLab and Cisco Firewall Flaws to KEV Catalog
The U.S. agency CISA has added a critical GitLab flaw enabling remote code execution and a Cisco firewall bug leading to denial of service to its catalog of known exploited vulnerabilities.
-
Alpine Linux rebuilds its GitLab after an attempted exploit of a critical vulnerability
An attacker came close to compromising Alpine Linux's GitLab instance via CVE-2026-97229. No evidence of a breach was found, but the server was rebuilt from scratch and all passwords were reset as a precaution.
-
Roku Moves Developer Repositories from GitHub to GitLab
Roku has announced on its developer blog that it is moving its code repositories from GitHub to GitLab.
-
Ruby Fixes Three Regex Engine Bugs Behind Four Critical GitLab RCE Flaws
Ruby has shipped 4.0.9, 3.4.12 and 3.3.13 to fix flaws in the Onigmo regex engine that drove four critical GitLab patches in a month. Any app that compiles a regular expression from attacker-controlled text is at risk.
-
Critical GitLab Flaw (CVSS 10.0) Threatens RCE Across 12 Years of Releases
On October 21 GitLab shipped fixes for a flaw that lets an attacker run code on a self-managed server without logging in. The weakness reaches back to version 7.0, released in 2014.
-
GitLab Patches Max-Severity Code Execution Flaw in CI/CD Regex Compiler
An integer overflow bug let an unauthenticated attacker run arbitrary code on a GitLab server through a specially crafted regular expression. The company urges immediate upgrades.
-
GitLab Patches Critical 9.9 AI Gateway Flaw Enabling Command Execution
A flaw rated 9.9 let a logged-in user with Duo Agent Platform access escape the prompt template sandbox and run arbitrary commands on the gateway. Only organizations that host their own AI Gateway need to act.
-
CISA: Critical GitLab Vulnerability Already Being Exploited in Attacks
The CISA agency has warned of active exploitation of a maximum-severity vulnerability in GitLab that allows secrets to be read from vulnerable servers without authentication.
-
GitLab Patches Critical Path Traversal Flaw in Commits API
GitLab has urged administrators to update their servers immediately: the maximum-severity vulnerability CVE-2026-85706 lets unauthenticated attackers read arbitrary files. A second critical flaw in GraphQL was patched at the same time.
-
Flood of AI Bug Reports in QEMU Called a DoS Attack on Maintainers
In a matter of minutes, one user filed more than 125 cookie-cutter, AI-generated bug reports in QEMU. A Red Hat engineer viewed it as a denial of service against the project's maintainers.
-
Critical GitLab Vulnerability CVE-2026-19478 Comes Under Exploitation Within Days
A fresh GitLab flaw rated CVSS 9.4 lets an unauthenticated attacker overwrite and delete public projects. According to watchTowr, real-world attacks began almost immediately after disclosure.
-
Critical GraphQL Flaw in GitLab Lets Attackers Delete Public Projects Without Authorization
GitLab has shipped an out-of-band security update closing the critical flaw CVE-2026-19478, rated CVSS 9.4, which under certain conditions gives an unauthenticated attacker the ability to modify and delete public projects and user data.
-
PoC Exploit for GitLab: An Authenticated User Gains Command Execution as git
A researcher has published a working exploit for unpatched self-managed GitLab: all it takes is to commit two crafted Jupyter notebooks and request a diff of them.