NIXPKGS-2026-1584

GitHub issue published 4 months ago

          Permalink
          
            CVE-2026-44348
          
        2.5 LOW
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Local (L)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): Low (L)
        
          Modified Attack Vector (MAV): Local (L)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): Low (L)
        
              updated
            
          4 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
                2 packages
                podofo_0_9
podofo_0_10

          4 months ago
          
          @LeSuisse
          
              accepted
            
          4 months ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months ago
          
            PoDoFo: Double-free vulnerability in compute_hash_to_sign()
          
      https://github.com/podofo/podofo/security/advisories/GHSA-8fq6-rqpv-xq72
    
    x_refsource_CONFIRMexploit
  
      https://github.com/podofo/podofo/commit/696d765c3a71ef224d4abffe1f174fef11292d7e
    
    x_refsource_MISC
  
    podofo

            ==>= 1.0.0, < 1.0.4

NIXPKGS-2026-1583

GitHub issue published 4 months ago

Permalink CVE-2026-43908

8.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

Created suggestion 4 months ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
4 months ago
@LeSuisse accepted 4 months ago
@LeSuisse published on GitHub 4 months ago

OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-2jr5-q49v-3858 x_refsource_CONFIRM

OpenImageIO

==>= 3.1.4.0-beta, < 3.1.13.0
==< 3.0.18.0

NIXPKGS-2026-1582

GitHub issue published 4 months ago

Permalink CVE-2026-41888

6.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): Low (L)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): Low (L)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

updated 4 months ago by @LeSuisse Activity log

Created suggestion 4 months ago
@LeSuisse ignored
23 packages
- protege-distribution
- perlPackages.LinuxDistribution
- perl5Packages.LinuxDistribution
- perl538Packages.LinuxDistribution
- perl540Packages.LinuxDistribution
- perlPackages.DistributionMetadata
- haskellPackages.normaldistribution
- perl5Packages.DistributionMetadata
- perlPackages.ParseLocalDistribution
- haskellPackages.distribution-nixpkgs
- perl538Packages.DistributionMetadata
- perl540Packages.DistributionMetadata
- perl5Packages.ParseLocalDistribution
- perlPackages.StatisticsDistributions
- haskellPackages.distribution-opensuse
- perl5Packages.StatisticsDistributions
- haskellPackages.splitmix-distributions
- perl538Packages.ParseLocalDistribution
- perl540Packages.ParseLocalDistribution
- haskellPackages.ngx-export-distribution
- perl538Packages.StatisticsDistributions
- perl540Packages.StatisticsDistributions
- haskellPackages.distribution-nixpkgs-unstable
4 months ago
@LeSuisse accepted 4 months ago
@LeSuisse published on GitHub 4 months ago

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

https://github.com/distribution/distribution/security/advisories/GHSA-6pjf-3r9x-m592 x_refsource_CONFIRMexploit

distribution

==< 3.1.1

NIXPKGS-2026-1581

GitHub issue published 4 months ago

Permalink CVE-2026-43907

8.3 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

Created suggestion 4 months ago
@LeSuisse ignored
4 packages
- colmap
- colmapWithCuda
- python313Packages.openimageio
- python314Packages.openimageio
4 months ago
@LeSuisse accepted 4 months ago
@LeSuisse published on GitHub 4 months ago

OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)

https://github.com/AcademySoftwareFoundation/OpenImageIO/security/advisories/GHSA-cq46-hp4h-cvfr x_refsource_CONFIRMexploit

OpenImageIO

==>= 3.1.4.0-beta, < 3.1.13.0
==< 3.0.18.0

NIXPKGS-2026-1580

GitHub issue published 4 months ago

          Permalink
          
            CVE-2026-7481
          
        8.7 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): Required (R)
        
          Scope (S): Changed (C)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): Required (R)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Changed (C)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          4 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          4 months ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @globin
@krav
@leona-ya
@yayayayaka
@talyz

          4 months ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          4 months ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months ago
          
            Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/598646
    
      HackerOne Bug Bounty Report #3697379
    
    technical-descriptionexploitpermissions-required
  
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
    GitLab

            <18.11.3
          
            <18.9.7
          
            <18.10.6

NIXPKGS-2026-1579

GitHub issue published 4 months ago

Permalink CVE-2026-6883

2.6 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 months ago by @LeSuisse Activity log

Created suggestion 4 months ago
@LeSuisse ignored
44 packages
- gitlab-art
- gitlab-duo
- gitlab-kas
- gitlab-ci-ls
- gitlab-pages
- gitlab-shell
- danger-gitlab
- gitlab-clippy
- gitlab-runner
- gitlab-triage
- gitlab-ci-local
- gitlab-timelogs
- gitlab-ci-linter
- gitlab-workhorse
- gitlab-release-cli
- ocamlPackages.gitlab
- vimPlugins.gitlab-vim
- gitlab-container-registry
- ocamlPackages.gitlab-jsoo
- ocamlPackages.gitlab-unix
- rubyPackages.gitlab-markup
- terraform-providers.gitlab
- ocamlPackages_latest.gitlab
- gitlab-elasticsearch-indexer
- haskellPackages.gitlab-haskell
- rubyPackages_3_3.gitlab-markup
- rubyPackages_3_4.gitlab-markup
- rubyPackages_4_0.gitlab-markup
- python312Packages.mkdocs-gitlab
- python312Packages.python-gitlab
- python313Packages.mkdocs-gitlab
- python313Packages.python-gitlab
- python314Packages.mkdocs-gitlab
- python314Packages.python-gitlab
- ocamlPackages_latest.gitlab-jsoo
- ocamlPackages_latest.gitlab-unix
- terraform-providers.gitlabhq_gitlab
- gnomeExtensions.gitlab-time-tracking
- prometheus-gitlab-ci-pipelines-exporter
- vscode-extensions.gitlab.gitlab-workflow
- perlPackages.AlienBuildPluginDownloadGitLab
- perl5Packages.AlienBuildPluginDownloadGitLab
- perl538Packages.AlienBuildPluginDownloadGitLab
- perl540Packages.AlienBuildPluginDownloadGitLab
4 months ago
@LeSuisse ignored
5 maintainers
- @talyz
- @leona-ya
- @globin
- @krav
- @yayayayaka
4 months ago maintainer.ignore
@LeSuisse accepted 4 months ago
@LeSuisse published on GitHub 4 months ago

Missing Authorization in GitLab

GitLab

<18.9.7
<18.11.3
<18.10.6

NIXPKGS-2026-1578

GitHub issue published 4 months ago

          Permalink
          
            CVE-2026-1659
          
        7.5 HIGH
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): None (N)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): None (N)
        
          Availability (A): High (H)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): None (N)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): None (N)
        
          Modified Availability (MA): High (H)
        
              updated
            
          4 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          4 months ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @globin
@yayayayaka
@krav
@talyz
@leona-ya

          4 months ago
          
              maintainer.ignore
            
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          4 months ago
          
          @LeSuisse
          
              accepted
            
          4 months ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months ago
          
            Allocation of Resources Without Limits or Throttling in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/588201
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3519824
    
    permissions-requiredtechnical-descriptionexploit
  
    GitLab

            <18.9.7
          
            <18.11.3
          
            <18.10.6

NIXPKGS-2026-1577

GitHub issue published 4 months ago

Permalink CVE-2026-42283

7.7 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 4 months ago by @LeSuisse Activity log

Created suggestion 4 months ago
@LeSuisse ignored
3 packages
- python312Packages.azure-mgmt-devspaces
- python313Packages.azure-mgmt-devspaces
- python314Packages.azure-mgmt-devspaces
4 months ago
@LeSuisse accepted 4 months ago
@LeSuisse published on GitHub 4 months ago

DevSpace UI Server WebSocket CheckOrigin does not validate source

https://github.com/devspace-sh/devspace/security/advisories/GHSA-hqwm-7x7x-8379 x_refsource_CONFIRM

devspace

==< 6.3.21

NIXPKGS-2026-1576

GitHub issue published 4 months ago

          Permalink
          
            CVE-2026-3607
          
        4.3 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): Low (L)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): None (N)
        
          Integrity (I): Low (L)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): Low (L)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): None (N)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): Low (L)
        
          Modified Availability (MA): None (N)
        
              updated
            
          4 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
                44 packages
                gitlab-art
gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          4 months ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @talyz
@leona-ya
@krav
@globin
@yayayayaka

          4 months ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          4 months ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months ago
          
            Access Control Check Implemented After Asset is Accessed in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/592466
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3586233
    
    technical-descriptionexploitpermissions-required
  
    GitLab

            <18.11.3
          
            <18.9.7
          
            <18.10.6

NIXPKGS-2026-1575

GitHub issue published 4 months ago

          Permalink
          
            CVE-2026-1322
          
        6.8 MEDIUM
      
        CVSS version (CVSS): 3.1
      
          Attack Vector (AV): Network (N)
        
          Attack Complexity (AC): High (H)
        
          Privileges Required (PR): Low (L)
        
          User Interaction (UI): None (N)
        
          Scope (S): Unchanged (U)
        
          Confidentiality (C): High (H)
        
          Integrity (I): High (H)
        
          Availability (A): None (N)
        
          Modified Attack Vector (MAV): Network (N)
        
          Modified Attack Complexity (MAC): High (H)
        
          Modified Privileges Required (MPR): Low (L)
        
          Modified User Interaction (MUI): None (N)
        
          Modified Confidentiality (MC): High (H)
        
          Modified Scope (MS): Unchanged (U)
        
          Modified Integrity (MI): High (H)
        
          Modified Availability (MA): None (N)
        
              updated
            
          4 months ago
          by @LeSuisse
        
      Activity log
    
              Created suggestion
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
              package gitlab-art
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
              reference HackerOne…
            
          4 months ago
          
          @LeSuisse
          
              ignored
            
                43 packages
                gitlab-duo
gitlab-kas
gitlab-ci-ls
gitlab-pages
gitlab-shell
danger-gitlab
gitlab-clippy
gitlab-runner
gitlab-triage
gitlab-ci-local
gitlab-timelogs
gitlab-ci-linter
gitlab-workhorse
gitlab-release-cli
ocamlPackages.gitlab
vimPlugins.gitlab-vim
gitlab-container-registry
ocamlPackages.gitlab-jsoo
ocamlPackages.gitlab-unix
rubyPackages.gitlab-markup
terraform-providers.gitlab
ocamlPackages_latest.gitlab
gitlab-elasticsearch-indexer
haskellPackages.gitlab-haskell
rubyPackages_3_3.gitlab-markup
rubyPackages_3_4.gitlab-markup
rubyPackages_4_0.gitlab-markup
python312Packages.mkdocs-gitlab
python312Packages.python-gitlab
python313Packages.mkdocs-gitlab
python313Packages.python-gitlab
python314Packages.mkdocs-gitlab
python314Packages.python-gitlab
ocamlPackages_latest.gitlab-jsoo
ocamlPackages_latest.gitlab-unix
terraform-providers.gitlabhq_gitlab
gnomeExtensions.gitlab-time-tracking
prometheus-gitlab-ci-pipelines-exporter
vscode-extensions.gitlab.gitlab-workflow
perlPackages.AlienBuildPluginDownloadGitLab
perl5Packages.AlienBuildPluginDownloadGitLab
perl538Packages.AlienBuildPluginDownloadGitLab
perl540Packages.AlienBuildPluginDownloadGitLab

          4 months ago
          
          @LeSuisse
          
              ignored
            
                5 maintainers
                @globin
@yayayayaka
@krav
@leona-ya
@talyz

          4 months ago
          
              maintainer.ignore
            
          @LeSuisse
          
              accepted
            
          4 months ago
          
          @LeSuisse
          
              published on GitHub
            
          4 months ago
          
            Business Logic Errors in GitLab
          
      https://gitlab.com/gitlab-org/gitlab/-/work_items/587270
    
      https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-relea…
    
          Ignored references (1)
        
      HackerOne Bug Bounty Report #3508895
    
    technical-descriptionexploitpermissions-required
  
    GitLab

            <18.11.3
          
            <18.9.7
          
            <18.10.6

Nixpkgs security tracker

Published issues

PoDoFo: Double-free vulnerability in compute_hash_to_sign()

OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

OpenImageIO: Integer overflow in QueryRGBBufferSizeInternal leads to heap out-of-bounds write in DPX decoder (kCbYCr and kABGR)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Missing Authorization in GitLab

Allocation of Resources Without Limits or Throttling in GitLab

DevSpace UI Server WebSocket CheckOrigin does not validate source

Access Control Check Implemented After Asset is Accessed in GitLab

Business Logic Errors in GitLab