Developer Tools

In GitLab CE/EE versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 a critical severity vulnerability CVE-2026-19478 was detected. This vulnerability allows an unauthenticated remote attacker to modify or delete public projects and user data, leading to severe data integrity compromise and potential data loss. This occurs due to an Improper Control of Generation of Code (Code Injection) flaw. Under certain conditions, an attacker can supply malicious input via a GraphQL directive that is improperly validated, tricking the application into executing unauthorized operations. To address this issue, users should upgrade GitLab CE/EE to versions 18.11.11, 19.0.8, 19.1.6, 19.2.4, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19478.

In OpenShift a high severity vulnerability CVE-2026-15218 was detected. This vulnerability allows an attacker to gain excessive permissions on the cluster. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15218.

In @fastify/busboy component for Node versions 3.1.0 through 3.2.0 a high severity vulnerability CVE-2026-19484 was detected. This vulnerability allows a remote unauthenticated attacker to stall the Node.js event loop. To address this issue, users should upgrade @fastify/busboy to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19484.

In OpenShift in affected versions a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows authenticated attackers to perform Server-Side Request Forgery (SSRF) attacks. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.

In GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 a high severity vulnerability CVE-2026-19228 was detected. This vulnerability allows an authenticated user to cause their AI usage to be attributed to another namespace. This occurs due to an Authorization Bypass Through User-Controlled Key flaw, where identity information supplied in requests is improperly authorized. By manipulating this information under certain conditions, an attacker can bypass intended access controls and shift AI usage accounting to a different tenant or namespace. To address this issue, users should upgrade GitLab EE to versions 19.1.4, 19.2.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-19228.

In OpenShift versions prior to the latest patch a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows authenticated attackers to make arbitrary network requests from the server’s privileged network position. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.

In previous versions of OpenShift a high severity vulnerability CVE-2026-50236 was detected. This vulnerability allows an authenticated attacker to target arbitrary endpoints from a privileged network position. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50236.

In previous versions of OpenShift a high severity vulnerability CVE-2026-50237 was detected. This vulnerability allows an attacker to bypass tenant egress restrictions. To address this issue, users should upgrade OpenShift to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50237.

In Portainer versions CE 2.44.0 and earlier a high severity vulnerability CVE-2026-72533 was detected. This vulnerability allows authenticated low-privileged users to bypass Docker proxy authorization checks. To address this issue, users should upgrade Portainer to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-72533.