GitHub / GitLab
Security news, advisories and exploited vulnerabilities.
News stories · 30d
38
Advisories · 30d
0
Added to KEV · 90d
1
Actively exploited (CISA KEV)
| Added | CVE | Product | Vulnerability | Ransomware |
|---|---|---|---|---|
| 2026-09-11 | CVE-2026-85706 | Community Edition and Enterprise Edition | GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability | |
| 2026-02-18 | CVE-2021-22175 | GitLab | GitLab Server-Side Request Forgery (SSRF) Vulnerability | |
| 2026-02-03 | CVE-2021-39935 | Community and Enterprise Editions | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability | |
| 2025-03-24 | CVE-2025-30154 | action-setup GitHub Action | reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability | |
| 2025-03-18 | CVE-2025-30066 | changed-files GitHub Action | tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability | |
| 2024-05-01 | CVE-2023-7028 | GitLab CE/EE | GitLab Community and Enterprise Editions Improper Access Control Vulnerability | |
| 2021-11-03 | CVE-2021-22205 | Community and Enterprise Editions | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability | Known |
CVEs in the news
Timeline (last 30 days)
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) — Rapid7, 2026-10-16
- Critical ChatGPT GitHub Connector Flaw Could Allow Attackers to Steal Private Repository Secrets — Cybersecurity News, 2026-10-15
- GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories — The Hacker News, 2026-10-15
- GitHub adopts cheaper AI model to catch secrets developers leave in code — Help Net Security, 2026-10-14
- Hackers Breach Meta GitHub Repositories, Steal Source Code and Data of 1,500 People — Cybersecurity News, 2026-10-14
- Hackers Breach Meta GitHub Repositories, Steal Source Code and Data of 1,500 People — Cybersecurity News, 2026-10-14
- GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking — The Hacker News, 2026-10-13
- Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach — SecurityWeek, 2026-10-13
- GitLab Patches Max-Severity Vulnerability CVE-2026-97229 — Security Affairs, 2026-10-13
- GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) — Help Net Security +3 sources, 2026-10-13
- GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code — The Hacker News, 2026-10-13
- Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data — Cybersecurity News, 2026-10-13
- GitLab fixes critical vulnerability that exposed software environments to sabotage — Cybersecurity Dive, 2026-10-12
- GitLab warns of max severity code execution vulnerability — BleepingComputer, 2026-10-12
- GhostAction Attack Escalates By Targeting GitHub Users — OpenSourceMalware, 2026-10-09
- Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories — The Hacker News, 2026-10-09
- StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines — StepSecurity, 2026-10-08
- FakeGit malware campaign returns with 17,610 malicious GitHub repos — BleepingComputer, 2026-10-08
- Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers — Help Net Security, 2026-10-08
- Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers — Help Net Security, 2026-10-08
- GitHub adds AI to catch passwords before a code push — Help Net Security, 2026-10-08
- GitHub adds AI to catch passwords before a code push — Help Net Security, 2026-10-08
- How to Investigate a GitHub Repo's Real History — OpenSourceMalware, 2026-10-06
- Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets — The Register, 2026-10-06
- GitHub’s ReviewBench puts AI code reviewers to the test — Help Net Security, 2026-10-06
- CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed — Security Affairs, 2026-10-03
- GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers — The Hacker News, 2026-10-02
- GitLab warns of critical RCE vulnerability in AI Gateway service — BleepingComputer, 2026-10-02
- 500,000 Active Credentials Left Exposed on GitHub — SecurityWeek, 2026-10-01
- Over 543,000 valid credentials exposed in public GitHub repositories — BleepingComputer +1 sources, 2026-09-30
- AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub — The Hacker News, 2026-09-30
- The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub — Wiz Research, 2026-09-29
- Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud — Socket, 2026-09-24
- AI-powered fuzzing with the GitHub Security Lab Taskflow Agent — GitHub Security Lab, 2026-09-24
- GitLab Email Addresses Can Be Weaponized for Supply Chain Attacks — Dark Reading, 2026-09-23
- Hundreds of Leaked GitHub App Keys Still Authenticate — Infosecurity Magazine, 2026-09-23
- Send GitLab an email, push to main — Aikido Security, 2026-09-23
- Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data — Dark Reading, 2026-09-22