Veeam patches critical Backup & Replication authorization bypass
Unauthenticated attackers can bypass CDP Coordinator checks; fixed builds are 13.1.2.57 and 13.0.3.63, with no exploitation reported.
74
Organization
HackerOne
- Mentions · 7d3
- Mentions · 30d18
- All mentions33
- First seenAug 17, 2026
- Last mentioned2d ago
Timeline
33 articles · newest firstGitLab patches max-severity regex compiler RCE (CVE-2026-110264)
Unauthenticated users can run code via integer overflow when a crafted regular expression is compiled.
74
Cloudflare opens PHP CTF for php2shell WAF bypasses
HackerOne participants must get code execution on PHP 8.5.11, read a resetting flag, and privately report a distinct bypass.
52
GitLab patches unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer overflow reaches GitLab 7.0 from June 2014; no in-the-wild exploitation is indicated yet.
76
GitLab patches unauthenticated regex RCE rated CVSS 10.0
CVE-2026-110264 reaches back to GitLab 7.0; self-managed admins must upgrade, and in-the-wild use is not confirmed.
82
GitLab fixes unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer-overflow bug scores CVSS 10.0, is fixed in seven releases, and has no confirmed attacks or public exploit.
76
curl will handle low and medium vulnerability reports in public
From October 26, 2026, only high and critical reports stay private on HackerOne; over 90% of recent submissions were below high.
48
Curl moves low and medium vulnerability reports public on October 26
High and critical reports stay private; Stenberg says over 90 percent of recent submissions were below high.
52
LLMs overestimate CVSS severity on bug bounty reports
Best prompting reached 49.58% level accuracy on 240 vendor-validated Huntr reports; fine-tuning a 7B model hit 56.25%.
52
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Rapid7 shows a reliable RCE proof of concept for GitLab's CVSS 10 regex flaw CVE-2026-97229.
68
12 Best Bug Bounty Platforms Compared (2026): Features & Pricing
A 2026 comparison ranks twelve bug bounty platforms, with HackerOne, Bugcrowd, Intigriti, and Synack leading.
14
GitLab warns of max severity code execution vulnerability
GitLab patched maximum-severity unauthenticated RCE CVE-2026-97229 in its CI/CD regex compiler.
78
Top 10 Best Bug Bounty Platforms in 2026 [Ranked & Scored]
A 2026 ranking places HackerOne, Bugcrowd, and Intigriti as the leading bug bounty platforms.
18
Critical Veeam Backup & Replication Flaw Allows Low-Privileged Users to Execute Remote Code
Veeam fixed a critical Backup & Replication flaw letting Backup Viewer users run remote code.
78
Google pauses open source bug bounty program after rise in AI submissions
Google paused its open-source bug bounty after invalid, mostly automated AI submissions overwhelmed reviewers.
48
Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
Google paused product-vulnerability submissions to its open-source bug bounty after a surge of invalid automated reports.
50
Google halts open-source bug bounty program amid AI spam surge
Google paused OSS Vulnerability Rewards submissions after a surge of invalid AI-generated bug reports.
58
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
GitLab patched CVE-2026-90970, a CVSS 9.9 command-execution flaw in self-hosted AI Gateway.
64
Cloudflare fixes Containers cross-tenant flaw exposing customer data
Cloudflare fixed a Containers flaw that let Workers Paid customers read residual data from other tenants on the same host.
73
OnePlus 15 Flaws Let Zero-Permission Apps Gain Root Access Through OxygenOS Services
OxygenOS flaws could let zero-permission apps gain root on OnePlus and OPPO devices.
57
Critical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex
GitLab patched two CVSS 9.9 flaws letting authenticated users execute code via malicious CI/CD regular expressions.
74
Cloudflare Containers Vulnerability Could Leak Data Between Customer Workloads
Cloudflare patched a Containers flaw that could let one tenant read residual disk data from another.
74
Exposed GitLab project email addresses let attackers push code
Aikido warns published GitLab incoming-email tokens can let outsiders open merge requests and push code as the owner.
61
AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code
Researchers chained a libheif RCE in Discourse with an over-privileged OpenAI forum sign-in token flaw to take over ChatGPT and Codex accounts.
72
Steam Windows 0-Day Vulnerability Allows Users to Silently Escalate to Full SYSTEM Privileges
A public BrokenPipe PoC exploits a signature-coverage flaw in Steam's Windows service, letting unprivileged local users gain NT AUTHORITY\SYSTEM without a patch or CVE.
62
CISO's Expert Guide to Agentic Pentesting for Websites
A new free guide urges CISOs to adopt autonomous AI agents for continuous website pentesting as attackers weaponize vulnerabilities in about five days.
25
CISA Warns of GitLab Path Traversal Vulnerability Exploited in Attacks
CISA added actively exploited GitLab path traversal flaw CVE-2026-85706 (CVSS 10.0) to its KEV catalog, setting a September 14 federal patch deadline.
88
OpenAI Announced $1B in Defensive Tools for Water Utilities
OpenAI pledges $1 billion in subsidized Daybreak cyber models and training for water utilities, grid operators, and other critical-infrastructure defenders.
55
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
78
AI AppSec tools agree on just 5% of security findings
Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.
45
GitLab Warns of Active Exploitation of Critical GraphQL Flaw
GitLab emergency-patches actively exploited flaw CVE-2026-19478 (CVSS 9.4), letting unauthenticated attackers modify or delete public projects on self-managed servers.
78
Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)
GitLab patched a critical unauthenticated code injection flaw CVE-2026-19478 (CVSS 9.4) enabling modification or deletion of public projects; upgrades urged.
65
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Wiz disclosed a GitHub Actions workflow injection in Snowflake's snowflake-connector-net repo that exposed Jira API tokens; Snowflake patched the flaw.
45
Related CVEs
by mentions- CVE-2026-1102641%10.0Unauthenticated RCE in GitLab CE/EE via regex integer overflow
- CVE-2026-8570697%10.0Unauthenticated Path Traversal Arbitrary File Read in GitLab CE/EE
- CVE-2026-9722918%10.0Unauthenticated RCE in GitLab CE/EE via CI/CD regex
- CVE-2026-194786%9.1Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
- LDAP account takeover in GitLab when SAML and LDAP auto-link are on
- Unauthenticated OAuth/OIDC cache poisoning in GitLab CE/EE
- Path traversal file read in Veeam Backup & Replication
- CVE-2026-0723<1%7.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have…
- GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have…
- Missing authorization in Veeam Backup & Replication
Appears with
- GitLabvendor · 12
- GitLab Enterprise Editionproduct · 7
- GitLab Community Editionproduct · 7
- Intigritiorganization · 4
- Microsoftvendor · 4
- CISAorganization · 4
- Bugcrowdorganization · 3
- Googlevendor · 3
- OSS VRPproduct · 3
- curlproduct · 3
- Cloudflarevendor · 3
- Cloud VRPproduct · 2
- GitLab CEproduct · 2
- Cloudflare Sandboxesproduct · 2
- GitLaborganization · 2
- GitLab EEproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.