Critical GitLab flaw allows account takeover without user interaction, patch quickly! (CVE-2023-7028)
60
60
GitLab’s critical flaw is already drawing internet-wide probes
GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.
GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.
78
60
60
60
60
60
60
New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution
60
60
Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution
60
60
Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws
60
GitLab Releases Patch for Critical CI/CD Pipeline Vulnerability and 13 Others
60
60
60
60
Over 400 IPs Exploiting Multiple SSRF Vulnerabilities in Coordinated Cyber Attack
60
Experts warn of a coordinated surge in the exploitation attempts of SSRF vulnerabilities
60
Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
60
August 2026 CVE Landscape
Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.
Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.
68
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
60
April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
60
60
Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
60
60
⚡ Weekly Recap: Apple 0-Days, WinRAR Exploit, LastPass Fines, .NET RCE, OAuth Scams & More
60
Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs
60
Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server
60
Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero
60
Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server
60
Microsoft Patches 125 Flaws Including Actively Exploited Windows CLFS Vulnerability
60
URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero
60
Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation
60
Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability
60
Microsoft Issues Patches for 79 Flaws, Including 3 Actively Exploited Windows Flaws
60
Microsoft Issues Patches for 90 Flaws, Including 10 Critical Zero
60
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60