60
60
60
Week in review: Exploited Ivanti Connect Secure zero-day, Patch Tuesday forecast
60
60
60
60
60
60
60
A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove
GitLab patched maximum-severity CVE-2026-85706, an unauthenticated path traversal enabling arbitrary file reads; CISA added it to KEV amid observed in-the-wild probes.
CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API caused by improper confinement and missing authentication enforcement, allowing arbitrary file reads in a single unauthenticated HTTP request. It affects GitLab CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and was reported via GitLab's HackerOne bug bounty. CISA added the flaw to its Known Exploited Vulnerabilities catalog, and watchTowr Intel reports already observing in-the-wild probes; GitLab is used by roughly 50% of the Fortune 100 with over 50 million registered users. Defenders are advised to patch immediately, rotate any exposed secrets, and hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters.
88
60
60
Week in review: Sudo local privilege escalation flaws fixed, Google patches actively exploited Chrome
60
60
Week in review: Critical SAP NetWeaver flaw exploited, RSAC 2025 Conference
60
60
Urgent: GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Job Execution
60
60
Week in review: Attackers use phishing emails to steal NTLM hashes, Patch Tuesday forecast
60
60
Week in review: 17 free AWS cybersecurity courses, exploited Chrome zero-day
60
60
60
60
Answering Log4Shell
60
60
60
60
60
60