{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:28.208Z","products":["gitlab"],"actNowTotal":2,"results":[{"query":"gitlab","matched":3,"actNow":2,"events":[{"id":"kev-2026-10-29-gitlab-community-edition-and-enterpri","url":"https://securitythreatpulse.com/events/kev-2026-10-29-gitlab-community-edition-and-enterpri","title":"GitLab Community Edition and Enterprise Edition: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 29 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 65%.","tier":"today","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public.","The confirmation is 13 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-97229"],"vendor":"GitLab","product":"Community Edition and Enterprise Edition","affectedProducts":[{"kind":"direct","slug":"gitlab/communityeditionandenterpriseedition","vendor":"GitLab","product":"Community Edition and Enterprise Edition","evidence":["kev"],"vendorKey":"gitlab","productKey":"communityeditionandenterpriseedition"},{"kind":"direct","slug":"gitlab/gitlab","vendor":"GitLab","product":"GitLab","evidence":["cpe"],"vendorKey":"gitlab","productKey":"gitlab"}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","cvss":10,"epss":0.6522,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-10-29","kevDueDate":"2026-11-01","firstSeenAt":"2026-10-29T00:00:00.000Z","updatedAt":"2026-11-11T01:30:24.106Z","newestEvidenceAt":"2026-11-11T06:28:08.292Z"},{"id":"kev-2026-09-11-gitlab-community-edition-and-enterpri","url":"https://securitythreatpulse.com/events/kev-2026-09-11-gitlab-community-edition-and-enterpri","title":"GitLab Community Edition and Enterprise Edition: attackers can read or change files","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 59 days old, so many systems are likely still unpatched. Ready-made attack tools are public. The severity score is critical (10.0). The exploit prediction score is 97%.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","Ready-made attack tools are public."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-85706"],"vendor":"GitLab","product":"Community Edition and Enterprise Edition","affectedProducts":[{"kind":"direct","slug":"gitlab/communityeditionandenterpriseedition","vendor":"GitLab","product":"Community Edition and Enterprise Edition","evidence":["kev"],"vendorKey":"gitlab","productKey":"communityeditionandenterpriseedition"},{"kind":"direct","slug":"gitlab/gitlab","vendor":"GitLab","product":"GitLab","evidence":["cpe"],"vendorKey":"gitlab","productKey":"gitlab"}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.","cvss":10,"epss":0.97355,"exploitMaturity":"weaponized","kevListed":true,"kevDateAdded":"2026-09-11","kevDueDate":"2026-09-14","firstSeenAt":"2026-09-11T00:00:00.000Z","updatedAt":"2026-11-10T03:00:07.880Z","newestEvidenceAt":"2026-11-02T18:00:07.000Z"},{"id":"early-cve-2026-110264","url":"https://securitythreatpulse.com/events/early-cve-2026-110264","title":"GitLab: attackers can run their own code","verdict":"watch","verdictReason":"One source reports attacks and the vulnerability is 20 days old. In our backtest a single early report was confirmed within 30 days about one time in twenty, so we wait for a second report or for attack attempts to be seen.","tier":null,"rankScore":2,"rankWhy":["Exploitation is reported.","The first report is 9 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-110264"],"vendor":"GitLab","product":"GitLab","affectedProducts":[{"kind":"direct","slug":"gitlab/gitlab","vendor":"GitLab","product":"GitLab","evidence":["cna","cpe"],"vendorKey":"gitlab","productKey":"gitlab"}],"category":{"id":"developer","label":"Developer tools","why":"It holds source code and the keys used to build and ship software.","doThis":"Patch it. If it faced the internet, change the keys and passwords stored in it."},"summary":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted…","cvss":10,"epss":0.01349,"exploitMaturity":"poc","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-02T18:00:07.000Z","updatedAt":"2026-11-11T01:00:05.314Z","newestEvidenceAt":"2026-11-05T22:43:29.279Z"}]}]}