10 reportsPriority High
GitLab vulnerability disclosures
Multiple vulnerabilities have been disclosed in GitLab Community and Enterprise Editions, with some reported to be actively exploited. UK organisations using these platforms should assess their exposure and apply updates.
First report Latest
What is going on
- GitLab released updated versions to address an improper access control vulnerability affecting both Community and Enterprise Editions with known exploitation reported.
- Two critical path traversal vulnerabilities were disclosed in GitLab Community and Enterprise Editions, with reports of active exploitation in the wild.
- A separate vulnerability in GitLab merge request pages was addressed, with known-exploited catalogue reports indicating potential exploitation.
- New vulnerabilities in Cisco Secure Firewall ASA and Secure FTD Software were added to the known-exploited catalogue due to active exploitation.
- A Windows Kernel vulnerability was reported to potentially expose sensitive system information, with confirmation required on its presence in affected estates.
- What to watch: Further confirmation of exploitation and updates on the status of the vulnerabilities in use across affected organisations.
Reports in this story
Newest first. Each one is a separate event with its own sources and evidence.
- Priority MediumType Vulnerability
GitLab Community and Enterprise Editions Access Control Flaw Vulnerability
- Priority MediumType Vulnerability
GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- Priority MediumType Vulnerability
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- Priority LowType Research & news
Bay Raises $50 Million to Control What Enterprise AI Agents Can Do
- Priority LowType Research & news
CISA flags Cisco BroadWorks flaw as actively exploited in attacks
- Priority HighType VulnerabilityLead report
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
- Priority LowType Vulnerability
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger through a repository they control
- Priority HighType Vulnerability
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
- Priority LowType Vulnerability
Access Control Flaw in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally
- Priority LowType Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally