🚨 GitLab Duo Chat Flaw Exposes Sensitive Search Credentials
GitLab EE administrators should patch as soon as possible, especially where Duo Chat is enabled. Review access and credentials after updating because the flaw can expose sensitive configuration data.
CVE-2026-87719 is a CRITICAL GitLab EE vulnerability affecting versions before 19.1.8, 19.2.6, and 19.3.2 in certain release branches. The issue allows an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials through a crafted GraphQL subscription argument. It has a CVSS score of 9.9.
🔗 Read more 🔗
Source: NVD
🔥 GitLab Repository API Bug Allows Unauthenticated File Reads
GitLab operators should treat this as an emergency patch because unauthenticated file access can expose server data. Prioritize updates and investigate logs for unexpected repository API activity.
CVE-2026-85706 is a CRITICAL GitLab CE/EE vulnerability affecting versions before 19.1.8, 19.2.6, and 19.3.2 in certain release branches. The flaw allows an unauthenticated user to read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API. It has a CVSS score of 10.0.
🔗 Read more 🔗
Source: NVD
🎧 stb_vorbis Heap Overflow Can Corrupt Memory
Developers and vendors embedding stb_vorbis should update affected builds and avoid processing untrusted audio files until patched. Applications handling user-supplied media are the highest priority.
CVE-2026-89266 is a HIGH severity vulnerability in stb_vorbis through version 1.22. The flaw is a heap buffer overflow in start_decoder() caused by allocation size truncation, allowing crafted Ogg Vorbis files to trigger out-of-bounds writes, crashes, or heap corruption. It has a CVSS score of 8.2.
🔗 Read more 🔗
Source: NVD
☁️ OpenStack Keystone Delegated Tokens Expose Credentials
OpenStack administrators using delegated authentication should patch quickly and review credential activity. Treat exposed MFA seeds and secrets as potentially compromised if affected deployments were accessible.
CVE-2026-90460 is a HIGH severity vulnerability in OpenStack Keystone before 29.0.3. Delegated authentication tokens can create, modify, or delete credentials through the /v3/credentials API, with EC2-derived tokens able to read credential blobs including TOTP MFA seeds and other secrets. It has a CVSS score of 7.6.
🔗 Read more 🔗
Source: NVD
🔑 Default Admin Password Leaves Inventory Component Exposed
Teams deploying the affected inventory component should rotate credentials immediately and verify production configurations. This is especially urgent for internet-facing administrative interfaces.
CVE-2026-90456 is a CRITICAL vulnerability involving a bundled inventory-management component configuration example with a fixed publicly-known administrative password. Deployments that copy the example configuration without regenerating credentials expose the administrative interface to attackers. It has a CVSS score of 9.2.
🔗 Read more 🔗
Source: NVD
🍪 Default Signing Secret Enables Authentication Cookie Forgery
Administrators should replace default secrets immediately and review authentication logs for suspicious access. Any deployment copied from example configuration files should be considered at risk until verified.
CVE-2026-90451 is a HIGH severity vulnerability involving a bundled packet-analysis component configuration example that contains a fixed publicly-known authentication cookie signing secret. Deployments using the unchanged value can allow attackers to forge valid authentication cookies. It has a CVSS score of 8.2.
🔗 Read more 🔗
Source: NVD
🛡️ Read-Only Deployment Bug Allows Unauthorized Data Changes
Operators using read-only deployments should patch promptly and validate that API routes enforce intended permissions. Review records for unauthorized modifications after remediation.
CVE-2026-90448 is a HIGH severity vulnerability in a deployment mode designed to provide read-only access to stored data. The flaw allows authenticated users to reach an API route that can create or overwrite records using elevated backend credentials. It has a CVSS score of 7.1.
🔗 Read more 🔗
Source: NVD
🚪 Authentication Routing Bypass Grants Elevated Access
Teams using the affected service should patch and review shared credentials immediately. Limit credential distribution and check for unexpected privileged actions.
CVE-2026-90447 is a HIGH severity vulnerability caused by authentication routing decisions based on a client-controlled request header. An authenticated attacker with a shared service credential can bypass the primary role-based authorization check and access elevated functionality. It has a CVSS score of 7.1.
🔗 Read more 🔗
Source: NVD
📦 Archive Upload Bug Enables Arbitrary File Writes
Applications accepting archive uploads should be patched and tested for unsafe extraction behavior. Prioritize systems where uploaded files can affect configuration or stored records.
CVE-2026-90445 is a HIGH severity vulnerability in an authenticated file upload interface. Attackers can craft archive files with path traversal entries to write files outside the intended directory, potentially modifying stored data or application configuration. It has a CVSS score of 7.1.
🔗 Read more 🔗
Source: NVD
💻 File Transfer Flaw Allows Authenticated Command Execution
Administrators should patch urgently and inspect systems for command execution attempts. This issue can provide an internal foothold, so monitor for lateral movement indicators.
CVE-2026-90444 is a HIGH severity vulnerability in a credential-protected file-transfer interface. Attacker-controlled filenames can inject shell metacharacters into later system commands, allowing authenticated attackers to execute arbitrary operating system commands. It has a CVSS score of 8.7.
🔗 Read more 🔗
Source: NVD
🎥 libde265 HEVC Decoder Memory Read Issue Fixed
Developers and maintainers shipping libde265 should update to version 1.1.1 or later. Prioritize systems that decode untrusted media streams.
CVE-2026-54241 is a HIGH severity vulnerability in libde265, an open source H.265 video codec implementation, affecting versions prior to 1.1.1. Crafted HEVC streams can trigger an integer overflow, undersized allocation, and out-of-bounds heap read that may expose heap data or crash the decoder. It has a CVSS score of 7.4.
🔗 Read more 🔗
Source: NVD
🎬 libde265 HEVC Decoder Overflow Can Corrupt Memory
Teams embedding libde265 should upgrade to version 1.1.1 and rebuild dependent applications. Media processing services handling external content should be patched first.
CVE-2026-54240 is a HIGH severity vulnerability in libde265, an open source H.265 video codec implementation, affecting versions prior to 1.1.1. Crafted HEVC streams can trigger an integer overflow leading to out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. It has a CVSS score of 7.4.
🔗 Read more 🔗
Source: NVD