Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    1288 vulnerabilities

    CVE-2026-18258 (GCVE-0-2026-18258)

    Vulnerability from cvelistv5 – Published: 2026-08-06 15:11 – Updated: 2026-08-06 15:45
    VLAI
    Title
    Authorization Bypass Through User-Controlled Key in eScriptorium
    Summary
    Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    Impacted products
    Vendor Product Version
    Scripta eScriptorium Affected: 0 , ≤ 26.4.1 (semver)
    Create a notification for this product.
    Credits
    Thibault Clérice & Hassen Aguili
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18258",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T15:45:38.837492Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-06T15:45:45.358Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "eScriptorium",
              "vendor": "Scripta",
              "versions": [
                {
                  "lessThanOrEqual": "26.4.1",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thibault Cl\u00e9rice \u0026 Hassen Aguili"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users\u0027 transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T15:11:28.257Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/scripta/escriptorium/-/work_items/1226"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9."
            }
          ],
          "title": "Authorization Bypass Through User-Controlled Key in eScriptorium"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18258",
        "datePublished": "2026-08-06T15:11:28.257Z",
        "dateReserved": "2026-07-29T16:34:04.697Z",
        "dateUpdated": "2026-08-06T15:45:45.358Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18277 (GCVE-0-2026-18277)

    Vulnerability from cvelistv5 – Published: 2026-08-06 15:11 – Updated: 2026-08-06 15:46
    VLAI
    Title
    Missing Authorization in eScriptorium
    Summary
    Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    Impacted products
    Vendor Product Version
    Scripta eScriptorium Affected: 0 , ≤ 26.4.1 (semver)
    Create a notification for this product.
    Credits
    Thibault Clérice & Hassen Aguili
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18277",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T15:46:02.475451Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-06T15:46:08.198Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "eScriptorium",
              "vendor": "Scripta",
              "versions": [
                {
                  "lessThanOrEqual": "26.4.1",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thibault Cl\u00e9rice \u0026 Hassen Aguili"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user\u0027s private OCR model and to revoke any user\u0027s OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T15:11:23.252Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/scripta/escriptorium/-/work_items/1227"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9."
            }
          ],
          "title": "Missing Authorization in eScriptorium"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18277",
        "datePublished": "2026-08-06T15:11:23.252Z",
        "dateReserved": "2026-07-29T17:05:38.309Z",
        "dateUpdated": "2026-08-06T15:46:08.198Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18359 (GCVE-0-2026-18359)

    Vulnerability from cvelistv5 – Published: 2026-08-06 15:11 – Updated: 2026-08-06 15:46
    VLAI
    Title
    Server-Side Request Forgery (SSRF) in eScriptorium
    Summary
    Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-918 - Server-Side Request Forgery (SSRF)
    Assigner
    Impacted products
    Vendor Product Version
    Scripta eScriptorium Affected: 0 , ≤ 26.4.1 (semver)
    Create a notification for this product.
    Credits
    Thibault Clérice & Hassen Aguili
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18359",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T15:46:22.465580Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-06T15:46:28.026Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "eScriptorium",
              "vendor": "Scripta",
              "versions": [
                {
                  "lessThanOrEqual": "26.4.1",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thibault Cl\u00e9rice \u0026 Hassen Aguili"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to \u0027*\u0027 and no address filtering, redirect cap or timeout is applied"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T15:11:13.252Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/scripta/escriptorium/-/work_items/1230"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9. As a mitigation on affected versions, set the IMPORT_ALLOWED_DOMAINS setting to an explicit list of permitted domains instead of leaving it at its default value of \u0027*\u0027."
            }
          ],
          "title": "Server-Side Request Forgery (SSRF) in eScriptorium"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18359",
        "datePublished": "2026-08-06T15:11:13.252Z",
        "dateReserved": "2026-07-30T08:33:41.193Z",
        "dateUpdated": "2026-08-06T15:46:28.026Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18275 (GCVE-0-2026-18275)

    Vulnerability from cvelistv5 – Published: 2026-08-06 15:11 – Updated: 2026-08-06 15:46
    VLAI
    Title
    Authorization Bypass Through User-Controlled Key in eScriptorium
    Summary
    Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    Impacted products
    Vendor Product Version
    Scripta eScriptorium Affected: 0 , ≤ 26.4.1 (semver)
    Create a notification for this product.
    Credits
    Thibault Clérice & Hassen Aguili
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18275",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T15:46:39.734521Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-06T15:46:45.820Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "eScriptorium",
              "vendor": "Scripta",
              "versions": [
                {
                  "lessThanOrEqual": "26.4.1",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thibault Cl\u00e9rice \u0026 Hassen Aguili"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users\u0027 document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T15:11:08.255Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/scripta/escriptorium/-/work_items/1228"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9."
            }
          ],
          "title": "Authorization Bypass Through User-Controlled Key in eScriptorium"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18275",
        "datePublished": "2026-08-06T15:11:08.255Z",
        "dateReserved": "2026-07-29T17:05:28.661Z",
        "dateUpdated": "2026-08-06T15:46:45.820Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18276 (GCVE-0-2026-18276)

    Vulnerability from cvelistv5 – Published: 2026-08-06 15:11 – Updated: 2026-08-06 15:47
    VLAI
    Title
    Missing Authorization in eScriptorium
    Summary
    Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    Impacted products
    Vendor Product Version
    Scripta eScriptorium Affected: 0 , ≤ 26.4.1 (semver)
    Create a notification for this product.
    Credits
    Thibault Clérice & Hassen Aguili
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18276",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-06T15:46:59.786117Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-06T15:47:06.237Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "eScriptorium",
              "vendor": "Scripta",
              "versions": [
                {
                  "lessThanOrEqual": "26.4.1",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thibault Cl\u00e9rice \u0026 Hassen Aguili"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document\u0027s event stream and observe another user\u0027s segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-06T15:11:03.369Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/scripta/escriptorium/-/work_items/1229"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to fixed version: 26.04.2, 1.0.1 or 0.13.9."
            }
          ],
          "title": "Missing Authorization in eScriptorium"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18276",
        "datePublished": "2026-08-06T15:11:03.369Z",
        "dateReserved": "2026-07-29T17:05:33.317Z",
        "dateUpdated": "2026-08-06T15:47:06.237Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18321 (GCVE-0-2026-18321)

    Vulnerability from cvelistv5 – Published: 2026-07-31 18:04 – Updated: 2026-07-31 18:54
    VLAI
    Title
    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec
    Summary
    Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
    Assigner
    References
    Impacted products
    Vendor Product Version
    NTPsec ntpsec Affected: 0 , < 1.2.5 (semver)
    Create a notification for this product.
    Credits
    Youngjoon Kim of Team Atlanta
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18321",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-31T18:54:02.722476Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-31T18:54:10.546Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "ntpsec",
              "vendor": "NTPsec",
              "versions": [
                {
                  "lessThan": "1.2.5",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Youngjoon Kim of Team Atlanta"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Buffer overflow in NTPsec\u0027s Zyfer refclock allows local attacker to crash ntpd"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-120",
                  "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-31T18:04:06.697Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/NTPsec/ntpsec/-/work_items/890"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 1.2.5"
            }
          ],
          "title": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027) in ntpsec"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18321",
        "datePublished": "2026-07-31T18:04:06.697Z",
        "dateReserved": "2026-07-29T19:04:09.259Z",
        "dateUpdated": "2026-07-31T18:54:10.546Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2025-14562 (GCVE-0-2025-14562)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:02 – Updated: 2026-07-29 19:33
    VLAI
    Title
    Incorrect Authorization in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 10.6 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-14562",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:33:37.371507Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:33:59.228Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "10.6",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [theluci](https://hackerone.com/theluci) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a member, due to improper authorization checks on merge request collaboration settings."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.1,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:02:26.038Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "name": "HackerOne Bug Bounty Report #3460445",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3460445"
            },
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/583889"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Incorrect Authorization in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2025-14562",
        "datePublished": "2026-07-29T19:02:26.038Z",
        "dateReserved": "2025-12-12T10:03:51.120Z",
        "dateUpdated": "2026-07-29T19:33:59.228Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-3093 (GCVE-0-2026-3093)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:02 – Updated: 2026-07-29 19:34
    VLAI
    Title
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 14.0 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-3093",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:34:51.686360Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:34:59.534Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "14.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user\u0027s browser via a crafted URL, due to improper sanitization of user-controlled input."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:02:11.038Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "name": "HackerOne Bug Bounty Report #3539833",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3539833"
            },
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/591274"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-3093",
        "datePublished": "2026-07-29T19:02:11.038Z",
        "dateReserved": "2026-02-24T02:34:16.776Z",
        "dateUpdated": "2026-07-29T19:34:59.534Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-4672 (GCVE-0-2026-4672)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:01 – Updated: 2026-07-29 19:35
    VLAI
    Title
    Missing Authorization in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 18.4 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [rogerace](https://hackerone.com/rogerace) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-4672",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:35:42.457995Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:35:54.247Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "18.4",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [rogerace](https://hackerone.com/rogerace) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view due to improper access control enforcement."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:01:31.039Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/594528"
            },
            {
              "name": "HackerOne Bug Bounty Report #3617676",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3617676"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Missing Authorization in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-4672",
        "datePublished": "2026-07-29T19:01:31.039Z",
        "dateReserved": "2026-03-23T21:03:56.356Z",
        "dateUpdated": "2026-07-29T19:35:54.247Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-6267 (GCVE-0-2026-6267)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:01 – Updated: 2026-07-31 16:10
    VLAI
    Title
    Insertion of Sensitive Information Into Sent Data in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-201 - Insertion of Sensitive Information Into Sent Data
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 10.1.0 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [thwin_htet](https://hackerone.com/thwin_htet) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-6267",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-30T03:55:43.298969Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-31T16:10:45.590Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "10.1.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [thwin_htet](https://hackerone.com/thwin_htet) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-201",
                  "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:01:16.040Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596606"
            },
            {
              "name": "HackerOne Bug Bounty Report #3658324",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3658324"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Insertion of Sensitive Information Into Sent Data in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-6267",
        "datePublished": "2026-07-29T19:01:16.040Z",
        "dateReserved": "2026-04-14T08:04:23.830Z",
        "dateUpdated": "2026-07-31T16:10:45.590Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-6336 (GCVE-0-2026-6336)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:01 – Updated: 2026-07-29 19:40
    VLAI
    Title
    Incorrect Authorization in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 16.6 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [3nvz](https://hackerone.com/3nvz) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-6336",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:40:43.985304Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:40:48.747Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "16.6",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [3nvz](https://hackerone.com/3nvz) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:01:06.041Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596762"
            },
            {
              "name": "HackerOne Bug Bounty Report #3661988",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3661988"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Incorrect Authorization in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-6336",
        "datePublished": "2026-07-29T19:01:06.041Z",
        "dateReserved": "2026-04-15T09:04:52.019Z",
        "dateUpdated": "2026-07-29T19:40:48.747Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-12436 (GCVE-0-2026-12436)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:00 – Updated: 2026-07-31 16:10
    VLAI
    Title
    Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 18.0 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [a0xnirudh](https://hackerone.com/a0xnirudh) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-12436",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-30T03:55:42.557469Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-31T16:10:56.005Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "18.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [a0xnirudh](https://hackerone.com/a0xnirudh) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-915",
                  "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:00:36.048Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/603223"
            },
            {
              "name": "HackerOne Bug Bounty Report #3800511",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3800511"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-12436",
        "datePublished": "2026-07-29T19:00:36.048Z",
        "dateReserved": "2026-06-16T19:08:45.458Z",
        "dateUpdated": "2026-07-31T16:10:56.005Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-13113 (GCVE-0-2026-13113)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:00 – Updated: 2026-07-29 19:43
    VLAI
    Title
    Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
    Summary
    GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 17.0 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    This vulnerability has been discovered internally by GitLab team member Niklas Janz
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-13113",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:42:19.157690Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:43:09.825Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "17.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "This vulnerability has been discovered internally by GitLab team member Niklas Janz"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race condition in approval rule processing."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:00:31.041Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/597838"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-13113",
        "datePublished": "2026-07-29T19:00:31.041Z",
        "dateReserved": "2026-06-23T20:33:43.206Z",
        "dateUpdated": "2026-07-29T19:43:09.825Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-14341 (GCVE-0-2026-14341)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:00 – Updated: 2026-07-29 19:45
    VLAI
    Title
    Missing Authorization in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 12.8 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [slide123](https://hackerone.com/slide123) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-14341",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:43:48.858149Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:45:32.122Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "12.8",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [slide123](https://hackerone.com/slide123) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization in a projects API endpoint."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:00:21.052Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604665"
            },
            {
              "name": "HackerOne Bug Bounty Report #3807593",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3807593"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Missing Authorization in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-14341",
        "datePublished": "2026-07-29T19:00:21.052Z",
        "dateReserved": "2026-07-01T13:45:49.828Z",
        "dateUpdated": "2026-07-29T19:45:32.122Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-14351 (GCVE-0-2026-14351)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:00 – Updated: 2026-07-29 19:33
    VLAI
    Title
    Exposure of Sensitive Information Through Metadata in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-1230 - Exposure of Sensitive Information Through Metadata
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 8.8 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    Thanks [toofikz](https://hackerone.com/toofikz) for reporting this vulnerability through our HackerOne bug bounty program
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-14351",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:33:44.703173Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:33:59.070Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "8.8",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thanks [toofikz](https://hackerone.com/toofikz) for reporting this vulnerability through our HackerOne bug bounty program"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request due to improper authorization checks."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1230",
                  "description": "CWE-1230: Exposure of Sensitive Information Through Metadata",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:00:16.040Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/604691"
            },
            {
              "name": "HackerOne Bug Bounty Report #3708242",
              "tags": [
                "technical-description",
                "exploit",
                "permissions-required"
              ],
              "url": "https://hackerone.com/reports/3708242"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Exposure of Sensitive Information Through Metadata in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-14351",
        "datePublished": "2026-07-29T19:00:16.040Z",
        "dateReserved": "2026-07-01T16:38:30.877Z",
        "dateUpdated": "2026-07-29T19:33:59.070Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15077 (GCVE-0-2026-15077)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:00 – Updated: 2026-07-29 19:33
    VLAI
    Title
    Improper Neutralization of Input Used for LLM Prompting in GitLab
    Summary
    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-1427 - Improper Neutralization of Input Used for LLM Prompting
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    This vulnerability has been discovered internally by GitLab team member Mike Wronski
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15077",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:33:13.987893Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:33:20.717Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "This vulnerability has been discovered internally by GitLab team member Mike Wronski"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to access information from unauthorized projects due to improper neutralization of untrusted content processed by the AI-assisted code review functionality."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1427",
                  "description": "CWE-1427: Improper Neutralization of Input Used for LLM Prompting",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:00:11.047Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/601482"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Improper Neutralization of Input Used for LLM Prompting in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15077",
        "datePublished": "2026-07-29T19:00:11.047Z",
        "dateReserved": "2026-07-08T15:36:58.778Z",
        "dateUpdated": "2026-07-29T19:33:20.717Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15831 (GCVE-0-2026-15831)

    Vulnerability from cvelistv5 – Published: 2026-07-29 19:00 – Updated: 2026-07-29 19:32
    VLAI
    Title
    Generation of Incorrect Security Tokens in GitLab
    Summary
    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-1270 - Generation of Incorrect Security Tokens
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    This vulnerability has been discovered internally by GitLab team member Dennis Appelt
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15831",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:32:41.478838Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:32:52.354Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "This vulnerability has been discovered internally by GitLab team member Dennis Appelt"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during token generation."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1270",
                  "description": "CWE-1270: Generation of Incorrect Security Tokens",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T19:00:01.048Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/605484"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Generation of Incorrect Security Tokens in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15831",
        "datePublished": "2026-07-29T19:00:01.048Z",
        "dateReserved": "2026-07-15T15:06:56.139Z",
        "dateUpdated": "2026-07-29T19:32:52.354Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15975 (GCVE-0-2026-15975)

    Vulnerability from cvelistv5 – Published: 2026-07-29 18:59 – Updated: 2026-07-29 19:32
    VLAI
    Title
    Allocation of Resources Without Limits or Throttling in GitLab
    Summary
    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 11.8 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    This vulnerability has been discovered internally by GitLab team member Hordur Freyr Yngvason
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15975",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:32:13.534654Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:32:20.549Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "11.8",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "This vulnerability has been discovered internally by GitLab team member Hordur Freyr Yngvason"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T18:59:56.043Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/601420"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Allocation of Resources Without Limits or Throttling in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15975",
        "datePublished": "2026-07-29T18:59:56.043Z",
        "dateReserved": "2026-07-16T15:37:27.210Z",
        "dateUpdated": "2026-07-29T19:32:20.549Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16553 (GCVE-0-2026-16553)

    Vulnerability from cvelistv5 – Published: 2026-07-29 18:59 – Updated: 2026-07-29 19:31
    VLAI
    Title
    Insufficiently Protected Credentials in GitLab
    Summary
    GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-522 - Insufficiently Protected Credentials
    Assigner
    Impacted products
    Vendor Product Version
    GitLab GitLab Affected: 18.8 , < 19.0.5 (semver)
    Affected: 19.1 , < 19.1.3 (semver)
    Affected: 19.2 , < 19.2.1 (semver)
        cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
    Create a notification for this product.
    Credits
    This vulnerability has been discovered internally by GitLab team member Fiona McCawley
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16553",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T19:31:32.638083Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T19:31:40.245Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "GitLab",
              "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
              "vendor": "GitLab",
              "versions": [
                {
                  "lessThan": "19.0.5",
                  "status": "affected",
                  "version": "18.8",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.1.3",
                  "status": "affected",
                  "version": "19.1",
                  "versionType": "semver"
                },
                {
                  "lessThan": "19.2.1",
                  "status": "affected",
                  "version": "19.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "This vulnerability has been discovered internally by GitLab team member Fiona McCawley"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-522",
                  "description": "CWE-522: Insufficiently Protected Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T18:59:46.164Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/603269"
            },
            {
              "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to versions 19.0.5, 19.1.3, 19.2.1 or above."
            }
          ],
          "title": "Insufficiently Protected Credentials in GitLab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-16553",
        "datePublished": "2026-07-29T18:59:46.164Z",
        "dateReserved": "2026-07-22T11:33:42.887Z",
        "dateUpdated": "2026-07-29T19:31:40.245Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18257 (GCVE-0-2026-18257)

    Vulnerability from cvelistv5 – Published: 2026-07-29 16:34 – Updated: 2026-07-29 18:04
    VLAI
    Title
    Improper Certificate Validation in S2OPC
    Summary
    Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-295 - Improper Certificate Validation
    Assigner
    References
    Impacted products
    Vendor Product Version
    Systerel S2OPC Affected: 1.5.0 , < 2.0.0 (semver)
    Create a notification for this product.
    Credits
    Systerel
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18257",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-29T18:04:43.478121Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-29T18:04:53.132Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "S2OPC",
              "vendor": "Systerel",
              "versions": [
                {
                  "lessThan": "2.0.0",
                  "status": "affected",
                  "version": "1.5.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Systerel"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "CWE-295: Improper Certificate Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-29T16:34:09.688Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://gitlab.com/systerel/S2OPC/-/work_items/1804"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Use mbedtls cryptographic wrapper of S2OPC. Or upgrade S2OPC to use CycloneCrypto wrapper of release version \u003e= 2.0.0 or master commit \u003e= 839ae878"
            }
          ],
          "title": "Improper Certificate Validation in S2OPC"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-18257",
        "datePublished": "2026-07-29T16:34:09.688Z",
        "dateReserved": "2026-07-29T16:33:59.899Z",
        "dateUpdated": "2026-07-29T18:04:53.132Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15168 (GCVE-0-2026-15168)

    Vulnerability from cvelistv5 – Published: 2026-07-08 21:47 – Updated: 2026-07-09 13:54
    VLAI
    Title
    Use of Uninitialized Variable in Wireshark
    Summary
    BLF file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows possible information disclosure
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-457 - Use of Uninitialized Variable
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Thai Duong Tran
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15168",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:53:59.967240Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:54:17.773Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21361"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Thai Duong Tran"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "BLF file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows possible information disclosure"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 2.5,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-457",
                  "description": "CWE-457: Use of Uninitialized Variable",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T21:47:19.856Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-60.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21361"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Use of Uninitialized Variable in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15168",
        "datePublished": "2026-07-08T21:47:19.856Z",
        "dateReserved": "2026-07-08T20:45:38.879Z",
        "dateUpdated": "2026-07-09T13:54:17.773Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15166 (GCVE-0-2026-15166)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:55 – Updated: 2026-07-09 13:13
    VLAI
    Title
    Stack-based Buffer Overflow in Wireshark
    Summary
    IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-121 - Stack-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Claude and Ada Logics
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15166",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:13:42.996528Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:13:51.109Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21391"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Claude and Ada Logics"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121: Stack-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:55:55.070Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-57.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21391"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Stack-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15166",
        "datePublished": "2026-07-08T20:55:55.070Z",
        "dateReserved": "2026-07-08T20:45:28.864Z",
        "dateUpdated": "2026-07-09T13:13:51.109Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15174 (GCVE-0-2026-15174)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:14
    VLAI
    Title
    Heap-based Buffer Overflow in Wireshark
    Summary
    Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Michael Bommarito
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15174",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:14:34.596925Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:14:37.906Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21270"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Michael Bommarito"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:51:25.274Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-52.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21270"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Heap-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15174",
        "datePublished": "2026-07-08T20:51:25.274Z",
        "dateReserved": "2026-07-08T20:46:08.884Z",
        "dateUpdated": "2026-07-09T13:14:37.906Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15172 (GCVE-0-2026-15172)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:42
    VLAI
    Title
    Unchecked Input for Loop Condition in Wireshark
    Summary
    FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-606 - Unchecked Input for Loop Condition
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Gabriel Rodrigues
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15172",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:42:40.189292Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:42:52.886Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Gabriel Rodrigues"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-606",
                  "description": "CWE-606: Unchecked Input for Loop Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:51:20.287Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-54.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21347"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Unchecked Input for Loop Condition in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15172",
        "datePublished": "2026-07-08T20:51:20.287Z",
        "dateReserved": "2026-07-08T20:45:58.875Z",
        "dateUpdated": "2026-07-09T13:42:52.886Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15173 (GCVE-0-2026-15173)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:44
    VLAI
    Title
    Heap-based Buffer Overflow in Wireshark
    Summary
    pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Create a notification for this product.
    Credits
    Mitchell Benjamin
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15173",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:44:18.595204Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:44:23.196Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21285"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Mitchell Benjamin"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:51:15.275Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-53.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21285"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Heap-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15173",
        "datePublished": "2026-07-08T20:51:15.275Z",
        "dateReserved": "2026-07-08T20:46:03.869Z",
        "dateUpdated": "2026-07-09T13:44:23.196Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15171 (GCVE-0-2026-15171)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:44
    VLAI
    Title
    NULL Pointer Dereference in Wireshark
    Summary
    SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-476 - NULL Pointer Dereference
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Dmitrijs Trizna
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15171",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:44:51.561918Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:44:55.663Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21378"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Dmitrijs Trizna"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "CWE-476: NULL Pointer Dereference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:51:10.283Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-55.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21378"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "NULL Pointer Dereference in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15171",
        "datePublished": "2026-07-08T20:51:10.283Z",
        "dateReserved": "2026-07-08T20:45:53.857Z",
        "dateUpdated": "2026-07-09T13:44:55.663Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15169 (GCVE-0-2026-15169)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:45
    VLAI
    Title
    Heap-based Buffer Overflow in Wireshark
    Summary
    UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Claude and Ada Logics
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15169",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:45:23.407997Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:45:27.007Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21398"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Claude and Ada Logics"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:51:05.273Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-59.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21398"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Heap-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15169",
        "datePublished": "2026-07-08T20:51:05.273Z",
        "dateReserved": "2026-07-08T20:45:43.874Z",
        "dateUpdated": "2026-07-09T13:45:27.007Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15167 (GCVE-0-2026-15167)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:51 – Updated: 2026-07-09 13:45
    VLAI
    Title
    Stack-based Buffer Overflow in Wireshark
    Summary
    DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-121 - Stack-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Nguyen Huu Trung
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15167",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:45:52.891240Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:45:58.260Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Nguyen Huu Trung"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121: Stack-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:51:00.295Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-62.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21352"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Stack-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15167",
        "datePublished": "2026-07-08T20:51:00.295Z",
        "dateReserved": "2026-07-08T20:45:33.866Z",
        "dateUpdated": "2026-07-09T13:45:58.260Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15170 (GCVE-0-2026-15170)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:50 – Updated: 2026-07-09 13:46
    VLAI
    Title
    Heap-based Buffer Overflow in Wireshark
    Summary
    Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Affected: 4.4.0 , < 4.4.17 (semver)
    Create a notification for this product.
    Credits
    Claude and Ada Logics
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15170",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:46:27.644761Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:46:30.782Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21397"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.4.17",
                  "status": "affected",
                  "version": "4.4.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Claude and Ada Logics"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:50:50.275Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-58.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21397"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Heap-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15170",
        "datePublished": "2026-07-08T20:50:50.275Z",
        "dateReserved": "2026-07-08T20:45:48.875Z",
        "dateUpdated": "2026-07-09T13:46:30.782Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15165 (GCVE-0-2026-15165)

    Vulnerability from cvelistv5 – Published: 2026-07-08 20:50 – Updated: 2026-07-09 13:47
    VLAI
    Title
    Heap-based Buffer Overflow in Wireshark
    Summary
    TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    Assigner
    Impacted products
    Vendor Product Version
    Wireshark Foundation Wireshark Affected: 4.6.0 , < 4.6.7 (semver)
    Create a notification for this product.
    Credits
    Claude and Ada Logics
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15165",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T13:46:53.770490Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T13:47:02.064Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21390"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Wireshark",
              "vendor": "Wireshark Foundation",
              "versions": [
                {
                  "lessThan": "4.6.7",
                  "status": "affected",
                  "version": "4.6.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Claude and Ada Logics"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "TLS ECH decryptor crash in Wireshark 4.6.0 to 4.6.6 allows denial of service"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "CWE-122: Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T20:50:45.283Z",
            "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
            "shortName": "GitLab"
          },
          "references": [
            {
              "url": "https://www.wireshark.org/security/wnpa-sec-2026-56.html"
            },
            {
              "url": "https://gitlab.com/wireshark/wireshark/-/work_items/21390"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to version 4.6.7 or above"
            }
          ],
          "title": "Heap-based Buffer Overflow in Wireshark"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "assignerShortName": "GitLab",
        "cveId": "CVE-2026-15165",
        "datePublished": "2026-07-08T20:50:45.283Z",
        "dateReserved": "2026-07-08T20:45:23.874Z",
        "dateUpdated": "2026-07-09T13:47:02.064Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }