Developer Tools

In Gogs versions up to and including 0.13.3 a high severity vulnerability CVE-2026-24135 was detected. This vulnerability allows authenticated users with write access to a repository’s wiki to exploit a path traversal issue in the `updateWikiPage` function by manipulating the `old_title` parameter, enabling deletion of arbitrary files on the server. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24135.

In Gogs versions up to and including 0.13.3 a high severity vulnerability CVE-2026-23633 was detected. This vulnerability allows attackers to exploit a path traversal issue in Git hook editing, enabling arbitrary file read and write operations on the server. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23633.

In Gogs versions up to and including 0.13.3 a medium severity vulnerability CVE-2026-23632 was detected. This vulnerability allows attackers with read-only repository permissions to modify repository contents due to missing write permission enforcement in the `PUT /repos/:owner/:repo/contents/*` endpoint, resulting in unauthorized commit creation and git push execution. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23632.

In Gogs versions up to and including 0.13.3 a medium severity vulnerability CVE-2026-22592 was detected. This vulnerability allows authenticated users to trigger a denial-of-service condition by deleting a repository file prior to synchronization, causing the application to crash. To address this issue, users should upgrade Gogs to versions 0.13.4, 0.14.0+dev, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-22592.

In GitLab CE/EE versions from 12.3 up to but not including 18.6.4, 18.7 up to but not including 18.7.2, and 18.8 up to but not including 18.8.2 a medium severity vulnerability CVE-2026-1102 was detected. This vulnerability allows unauthenticated attackers to create a denial of service condition by sending repeated malformed SSH authentication requests, due to improper allocation of resources without adequate limits or throttling. To address this issue, users should upgrade GitLab to versions 18.6.4, 18.7.2, 18.8.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1102.

In GitLab CE/EE versions from 18.6 up to but not including 18.6.4, 18.7 up to but not including 18.7.2, and 18.8 up to but not including 18.8.2 a high severity vulnerability CVE-2026-0723 was detected. This vulnerability allows an attacker with prior knowledge of a victim’s credential ID to bypass two-factor authentication by submitting forged device responses, due to an unchecked return value. To address this issue, users should upgrade GitLab to versions 18.6.4, 18.7.2, 18.8.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-0723.

In GitLab CE/EE versions from 17.7 up to but not including 18.6.4, 18.7 up to but not including 18.7.2, and 18.8 up to but not including 18.8.2 a high severity vulnerability CVE-2025-13928 was detected. This vulnerability allows unauthenticated attackers to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints. To address this issue, users should upgrade GitLab to versions 18.6.4, 18.7.2, 18.8.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13928.

In GitLab CE/EE versions from 11.9 up to but not including 18.6.4, 18.7 up to but not including 18.7.2, and 18.8 up to but not including 18.8.2 a high severity vulnerability CVE-2025-13927 was detected. This vulnerability allows unauthenticated attackers to create a denial of service condition by sending crafted requests containing malformed authentication data, due to improper allocation of resources without limits or throttling. To address this issue, users should upgrade GitLab CE/EE to versions 18.6.4, 18.7.2, 18.8.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-13927.

In Backstage and the @backstage/backend-defaults package versions prior to 0.12.2, 0.13.2, 0.14.1, and 0.15.0 a low severity vulnerability CVE-2026-24048 was detected. This vulnerability allows attackers who control an allowed external host to perform Server-Side Request Forgery (SSRF) by abusing automatic HTTP redirect handling in the FetchUrlReader component, enabling access to internal or sensitive URLs that are not explicitly allowlisted. To address this issue, users should upgrade @backstage/backend-defaults to versions 0.12.2, 0.13.2, 0.14.1, 0.15.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24048.