CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure.

GitLab’s non-expiring incoming email token can let a holder commit code with a user’s permissions and trigger CI/CD jobs.

Hackers are actively stealing secrets from vulnerable GitLab instances. Exposed secrets can include credentials for cloud accounts, container registries, and source code repositories. Public scans ...

Hello!"I'm supposed to be having AI write my code, but I feel like I'm doing more work than it is.""My day ends with a ...

U.S. CISA adds GitLab, JFrog Artifactory, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog.

On September 29, OpenAI held its developer event, "DevDay 2026."There were over 20 announcements: a new model, new Codex ...

The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing's state security service.

CVE-2026-85706 is a critical GitLab path-traversal vulnerability that has moved beyond theoretical risk into confirmed ...

CISA has added a critical GitLab vulnerability, tracked as CVE-2026-85706, to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw.

GitLab released emergency updates for two critical flaws enabling authenticated users to execute arbitrary code via crafted ...

A single HTTP POST request to the /api/v4/projects/{id}/repository/commits/ endpoint is sufficient to bypass security controls and read arbitrary files from a GitLab server. This path traversal ...

GitLab patched a maximum-severity vulnerability that could allow an unauthenticated attacker to read arbitrary files from a self-managed server. CISA added the flaw to its Known Exploited ...