Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad alta en GitLab CE/EE permite ejecución remota de código

GitLab ha reportado una vulnerabilidad de path traversal en el registro de paquetes que afecta versiones 18.8 a 19.2.1, permitiendo a usuarios autenticados ejecutar código remoto. Esta afecta directamente a empresas en LATAM que utilizan GitLab como plataforma de CI/CD y gestión de repositorios. El CVSS 8.5 indica severidad alta, requiriendo acción inmediata en entornos productivos.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-19478] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19650] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-19228] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 …

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16494] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 …

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-15216] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 …

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-15217] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 …

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16627] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that u…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-15423] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 …

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72867] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomp…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trig…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-6267] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-15975] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 …

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-12436] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 …

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61462] mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that al…

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.

nvdaltovulnerabilidad CVSS 8.6 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-6896] GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 b…

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-13320] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58370] Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For t…

Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For the GitLab forge driver, pipeline.Author is populated from the git commit author name (commit.author.name) carried in the webhook payload, which is attacker-controlled and not verified by GitLab. A user who can open a merge request from a fork can set the commit author name to match an entry in Appro…

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-10086] GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 be…

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-10712] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.

nvdaltovulnerabilidad CVSS 8.0 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-12053] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that unde…

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows.

nvdaltovulnerabilidad CVSS 8.6 NVD