https://vulnogram.org/ Most recent CVEs assigned by GitLab Inc. (gitlab). https://vulnogram.org/seaview/icons/gitlab.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-107571 https://vulnogram.org/CVE-2026-107571 Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose per… High Mon, 19 Oct 2026 15:34:47 GMT https://vulnogram.org/CVE-2026-107569 https://vulnogram.org/CVE-2026-107569 Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, re… High Network Exploitable Mon, 19 Oct 2026 15:34:37 GMT https://vulnogram.org/CVE-2026-107566 https://vulnogram.org/CVE-2026-107566 Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address,… Medium Mon, 19 Oct 2026 15:34:27 GMT https://vulnogram.org/CVE-2026-107568 https://vulnogram.org/CVE-2026-107568 Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve noti… Medium Mon, 19 Oct 2026 15:34:22 GMT https://vulnogram.org/CVE-2026-107567 https://vulnogram.org/CVE-2026-107567 Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and D… High Network Exploitable Mon, 19 Oct 2026 15:34:17 GMT https://vulnogram.org/CVE-2026-96425 https://vulnogram.org/CVE-2026-96425 Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus Medium Fri, 16 Oct 2026 15:35:22 GMT https://vulnogram.org/CVE-2026-96424 https://vulnogram.org/CVE-2026-96424 Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus High Fri, 16 Oct 2026 15:35:17 GMT https://vulnogram.org/CVE-2026-18516 https://vulnogram.org/CVE-2026-18516 An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection Critical Network Exploitable Fri, 16 Oct 2026 13:37:55 GMT https://vulnogram.org/CVE-2026-90821 https://vulnogram.org/CVE-2026-90821 An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input Medium Fri, 16 Oct 2026 13:37:40 GMT https://vulnogram.org/CVE-2026-109119 https://vulnogram.org/CVE-2026-109119 Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request. High Fri, 16 Oct 2026 10:27:28 GMT https://vulnogram.org/CVE-2026-109118 https://vulnogram.org/CVE-2026-109118 Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence… Medium Fri, 16 Oct 2026 10:27:18 GMT https://vulnogram.org/CVE-2026-5954 https://vulnogram.org/CVE-2026-5954 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to… Medium Tue, 13 Oct 2026 01:10:06 GMT https://vulnogram.org/CVE-2026-6567 https://vulnogram.org/CVE-2026-6567 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted… Medium Tue, 13 Oct 2026 01:09:46 GMT https://vulnogram.org/CVE-2026-7767 https://vulnogram.org/CVE-2026-7767 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to caus… Medium Tue, 13 Oct 2026 01:09:21 GMT https://vulnogram.org/CVE-2026-9268 https://vulnogram.org/CVE-2026-9268 GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project… Low Tue, 13 Oct 2026 01:08:56 GMT https://vulnogram.org/CVE-2026-14210 https://vulnogram.org/CVE-2026-14210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Per… Medium Tue, 13 Oct 2026 01:08:41 GMT https://vulnogram.org/CVE-2026-14552 https://vulnogram.org/CVE-2026-14552 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential… Medium Tue, 13 Oct 2026 01:08:31 GMT https://vulnogram.org/CVE-2026-14814 https://vulnogram.org/CVE-2026-14814 GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing tar… High Tue, 13 Oct 2026 01:08:26 GMT https://vulnogram.org/CVE-2026-16275 https://vulnogram.org/CVE-2026-16275 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public… Medium Network Exploitable Tue, 13 Oct 2026 01:08:16 GMT https://vulnogram.org/CVE-2026-16301 https://vulnogram.org/CVE-2026-16301 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pi… High Tue, 13 Oct 2026 01:08:11 GMT https://vulnogram.org/CVE-2026-78335 https://vulnogram.org/CVE-2026-78335 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained P… Medium Tue, 13 Oct 2026 01:08:01 GMT https://vulnogram.org/CVE-2026-81839 https://vulnogram.org/CVE-2026-81839 GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a… High Tue, 13 Oct 2026 01:07:51 GMT https://vulnogram.org/CVE-2026-82632 https://vulnogram.org/CVE-2026-82632 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Tok… Low Tue, 13 Oct 2026 01:07:11 GMT https://vulnogram.org/CVE-2026-84284 https://vulnogram.org/CVE-2026-84284 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from priva… Medium Network Exploitable Tue, 13 Oct 2026 01:06:56 GMT https://vulnogram.org/CVE-2026-85529 https://vulnogram.org/CVE-2026-85529 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidenti… Medium Network Exploitable Tue, 13 Oct 2026 01:06:16 GMT https://vulnogram.org/CVE-2026-92528 https://vulnogram.org/CVE-2026-92528 GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having… Medium Tue, 13 Oct 2026 01:06:01 GMT https://vulnogram.org/CVE-2026-92883 https://vulnogram.org/CVE-2026-92883 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the… High Tue, 13 Oct 2026 01:05:51 GMT https://vulnogram.org/CVE-2026-97229 https://vulnogram.org/CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitL… Critical Network Exploitable Tue, 13 Oct 2026 01:05:46 GMT https://vulnogram.org/CVE-2026-96893 https://vulnogram.org/CVE-2026-96893 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into A… High Tue, 13 Oct 2026 01:05:41 GMT https://vulnogram.org/CVE-2026-100104 https://vulnogram.org/CVE-2026-100104 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery… Low Tue, 13 Oct 2026 01:05:36 GMT https://vulnogram.org/CVE-2026-100755 https://vulnogram.org/CVE-2026-100755 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page co… Medium Tue, 13 Oct 2026 01:05:31 GMT https://vulnogram.org/CVE-2026-101168 https://vulnogram.org/CVE-2026-101168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to… Medium Tue, 13 Oct 2026 01:05:21 GMT https://vulnogram.org/CVE-2026-103549 https://vulnogram.org/CVE-2026-103549 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to rem… Low Tue, 13 Oct 2026 01:05:11 GMT https://vulnogram.org/CVE-2026-104661 https://vulnogram.org/CVE-2026-104661 GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance fram… Medium Tue, 13 Oct 2026 01:05:06 GMT https://vulnogram.org/CVE-2026-105458 https://vulnogram.org/CVE-2026-105458 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to… Medium Tue, 13 Oct 2026 01:04:51 GMT https://vulnogram.org/CVE-2026-107586 https://vulnogram.org/CVE-2026-107586 Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the serv… Medium Thu, 08 Oct 2026 15:11:24 GMT https://vulnogram.org/CVE-2026-107585 https://vulnogram.org/CVE-2026-107585 Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a… Medium Network Exploitable Thu, 08 Oct 2026 15:11:19 GMT https://vulnogram.org/CVE-2026-107589 https://vulnogram.org/CVE-2026-107589 Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names. High Thu, 08 Oct 2026 15:11:04 GMT https://vulnogram.org/CVE-2026-107584 https://vulnogram.org/CVE-2026-107584 Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply),… High Network Exploitable Thu, 08 Oct 2026 11:49:16 GMT https://vulnogram.org/CVE-2026-107583 https://vulnogram.org/CVE-2026-107583 Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailabl… Medium Network Exploitable Thu, 08 Oct 2026 11:49:06 GMT https://vulnogram.org/CVE-2026-107587 https://vulnogram.org/CVE-2026-107587 Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the att… Medium Network Exploitable Thu, 08 Oct 2026 11:49:01 GMT https://vulnogram.org/CVE-2026-107582 https://vulnogram.org/CVE-2026-107582 Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console an… Medium Network Exploitable Thu, 08 Oct 2026 11:48:26 GMT https://vulnogram.org/CVE-2026-107581 https://vulnogram.org/CVE-2026-107581 Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command.… Medium Thu, 08 Oct 2026 11:47:16 GMT https://vulnogram.org/CVE-2026-107580 https://vulnogram.org/CVE-2026-107580 Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending… Medium Network Exploitable Thu, 08 Oct 2026 11:47:11 GMT https://vulnogram.org/CVE-2026-107579 https://vulnogram.org/CVE-2026-107579 Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint process… High Network Exploitable Thu, 08 Oct 2026 11:47:06 GMT https://vulnogram.org/CVE-2026-107578 https://vulnogram.org/CVE-2026-107578 Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service ac… Medium Thu, 08 Oct 2026 11:47:01 GMT https://vulnogram.org/CVE-2026-107576 https://vulnogram.org/CVE-2026-107576 Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building t… High Network Exploitable Thu, 08 Oct 2026 11:46:56 GMT https://vulnogram.org/CVE-2026-107577 https://vulnogram.org/CVE-2026-107577 Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a… High Network Exploitable Thu, 08 Oct 2026 11:46:51 GMT https://vulnogram.org/CVE-2026-107575 https://vulnogram.org/CVE-2026-107575 Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a… Medium Network Exploitable Thu, 08 Oct 2026 11:46:46 GMT https://vulnogram.org/CVE-2026-107572 https://vulnogram.org/CVE-2026-107572 Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a back… Medium Thu, 08 Oct 2026 11:46:41 GMT