A security flaw in GitLab's email-to-issue feature allows an embedded token to be used across an entire account, potentially enabling unauthorised code execution.
GitLab has addressed a critical path traversal vulnerability, CVE-2026-85706, which enables unauthenticated attackers to access arbitrary files and secrets.
A maximum-severity GitLab vulnerability is being actively exploited by threat actors to access sensitive configuration files and secrets, risking software supply chain compromises.
CISA has warned that hackers are actively exploiting a maximum-severity GitLab vulnerability that allows unauthenticated attackers to steal credentials and secrets.
Threat actors are actively exploiting a critical path traversal vulnerability in GitLab, allowing unauthenticated users to access arbitrary files on affected servers.
