GitLab patches unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer overflow reaches GitLab 7.0 from June 2014; no in-the-wild exploitation is indicated yet.
2
Stories per day · 30 days
2 RSS
7 stories, newest first · one card per story
Stories tagged #self-managed
GitLab fixes unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer-overflow bug scores CVSS 10.0, is fixed in seven releases, and has no confirmed attacks or public exploit.
3
GitLab fixes unauthenticated RCE back to version 7.0 (CVE-2026-110264)
The CVSS 10.0 Onigmo overflow has no known attacks and no workaround; only self-managed installs must upgrade.
GitLab CVE-2026-85706 Added to CISA KEV
CISA added CVE-2026-85706 to KEV: a path traversal in GitLab CE/EE letting unauthenticated attackers read arbitrary files.
2
CVE-2026-85706 | GitLab CE/EE Repository Commits API Path Traversal Vulnerability
GitLab patches CVSS 10.0 path traversal CVE-2026-85706 letting unauthenticated attackers read arbitrary files on self-managed CE/EE servers.
2
GitLab Warns of Active Exploitation of Critical GraphQL Flaw
GitLab emergency-patches actively exploited flaw CVE-2026-19478 (CVSS 9.4), letting unauthenticated attackers modify or delete public projects on self-managed servers.
2
GitLab Patches Critical Unauthenticated GraphQL Vulnerability
GitLab issued an emergency patch for a critical unauthenticated GraphQL flaw (CVE-2026-19478, CVSS 9.4) enabling remote modification or deletion of public projects.