30
42
30
30
55
30
55
55
42
30
30
30
30
60
30
GitLab’s critical flaw is already drawing internet-wide probes
GitLab patches two critical flaws (CVE-2026-85706 CVSS 10.0, CVE-2026-87719) as WatchTowr observes internet-wide probing of the unauthenticated file-read bug.
GitLab released emergency patches for two high-severity flaws in Community and Enterprise Editions, urging self-managed operators to upgrade immediately while saying its hosted and Dedicated offerings are fixed or unaffected. CVE-2026-85706 (CVSS 10.0) is a path traversal in the repository commits interface that lets unauthenticated attackers read any file on the server and affects releases 18.7 through 19.1.8 plus the 19.2 and 19.3 lines before patching. CVE-2026-87719 (CVSS 9.9, Enterprise Edition only) lets a logged-in Duo Chat user hide a command in a request that triggers Advanced Search settings and password disclosure. WatchTowr Labs reported it is already watching probes that can trigger the path traversal flaw in a single HTTP request, though CISA had not added either issue to the KEV list as of Friday afternoon.
78
Three 10.0 security flaws fixed across Ubiquiti’s UniFi line
Ubiquiti patches 22 UniFi vulnerabilities, 21 rated critical including three CVSS 10.0 flaws enabling unauthorized access.
Ubiquiti disclosed and patched 22 vulnerabilities, 21 rated critical and three assigned the maximum CVSS 10.0 score: CVE-2026-77537, CVE-2026-77550, and CVE-2026-77554. All three involve improper access control that could let attackers gain privileges, while other flaws permit authentication bypass or arbitrary command execution. All but one of the 22 affect the UniFi product line. The company did not confirm whether any were exploited before patching.
70
60
55
Microsoft discloses ‘the mother of all’ vulnerability loads, tripling June’s previous record
60
55
55
60
60
55
60
60
60
60
60
60
60
60
55
60
60
60
60
42
60