Sunday, October 18, 2026

GitLab

GitLab Email Token Lets Attackers Push Code to Main and Execute CI/CD Jobs

A long-lived GitLab incoming email token embedded in project email addresses for the "Email work item" feature can be exploited to push attacker-controlled code, create merge requests, and trigger...

GitLab Duo Claude AI Agent Flaw Lets Attackers Execute Arbitrary Commands in CI Pipelines

GitLab has released security updates for both its Community Edition and Enterprise Edition, addressing seven vulnerabilities, including a high-severity flaw in its Duo Claude...

GitLab Patches 8 Vulnerabilities Affecting CE and EE Installations

GitLab has released critical security updates to address eight vulnerabilities in its Community Edition (CE) and Enterprise Edition (EE). Administrators are urged to upgrade...

GitLab Patches Multiple Vulnerabilities Allowing Account Takeover

GitLab has released security updates for GitLab CE/EE and EE that patch multiple vulnerabilities, including several high‑impact flaws that could lead to account takeover,...

GitHub, GitLab Abused for Malware and Phishing Campaigns

Hackers are increasingly abusing trusted software development platforms GitHub and GitLab to host malware and credential phishing campaigns, making defensive detection significantly harder for...

GitLab Patches Multiple Vulnerabilities Enabling DoS and Cross-Site Scripting Attacks

GitLab has released critical security updates for its Community Edition (CE) and Enterprise Edition (EE) to address multiple high-severity vulnerabilities. These patches, detailed in...