CVE Vulnerability Catalog

GitLab EE in versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains an issue that under certain conditions could allow an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks.

GitLab EE contains a cleanup logic flaw that fails to distinguish pre-existing vulnerability records from newly created ones during error handling. Under certain conditions, an authenticated user with read-only permissions could permanently delete existing vulnerability records. This issue affects versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1.

GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 contains a vulnerability where an unauthenticated user could poison a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

GitLab CE/EE across many versions contains an integer overflow when compiling a specially crafted regular expression. Under certain conditions this could allow an unauthenticated user to execute arbitrary code on the GitLab server.

GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 could, under certain conditions, allow an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers.

GitLab has remediated an issue in GitLab CE/EE affecting versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 where, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.

GitLab has remediated an issue in GitLab EE affecting versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 where, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could re-enable AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls.

A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials.

Cisco's internal security review discovered multiple vulnerabilities related to files or directories accessible to external parties (CWE-552). Fixes were released as part of a software hardening update.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 relate to the use of non-canonical URL paths for authorization decisions (CWE-647).

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76529 relates to improper protection of alternate path (CWE-424).

Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76528 relate to protection mechanism failure and are grouped under CWE-693.

Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76527 relate to improper check or handling of exceptional conditions and are grouped under CWE-703.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76526 relates to improper neutralization (CWE-707).

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76408 relates to improper control of a resource through its lifetime (CWE-664).

Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76407 relate to improper access control and are grouped under CWE-284.

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data can submit Basic authentication data to the REST API to expose and decrypt that data. The vulnerability exists because Splunk SOAR decrypts encrypted Basic authentication values before completing authentication checks. The attack requires the user to possess encrypted credential data from an affected instance.

In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the REST API, causing Splunk SOAR to apply the license change. The vulnerability exists because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before applying the license change.

In Splunk SOAR versions below 8.7.0, a user holding a role with the Users and Roles view permission could use the REST API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance. The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.

In Splunk SOAR versions below 8.7.0, a user with the "Observer" role could use REST API query filters to infer password hashes and authorization tokens for other users. The disclosure occurs because query filters are applied to user records before sensitive fields are protected.