{"vulnerability": "CVE-2026-8570", "sightings": [{"uuid": "392a7d26-1ed8-4175-840c-4ee89296ccc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8570", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260515", "content": "", "creation_timestamp": "2026-05-14T18:00:00.000000Z"}, {"uuid": "a6c759bb-b6af-4391-a92d-48996260fefd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8570", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260518", "content": "", "creation_timestamp": "2026-05-17T18:00:00.000000Z"}, {"uuid": "65ab8839-45c9-4e73-8269-d168b0f64610", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85702", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/j74zbtuplef5k", "content": "CVE-2026-85702 - ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication\nCVE ID : CVE-2026-85702\n \n Published : Sept. 4, 2026, 8:30 p.m. | 52\u00a0minutes ago\n \n Description : A security vulnerability has been detected in ramon-victor fre...", "creation_timestamp": "2026-09-04T21:24:55.150992Z"}, {"uuid": "18dac316-c2c7-4918-b3aa-101e349564e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85703", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/bryy3ucpykyh7", "content": "CVE-2026-85703 - ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources\nCVE ID : CVE-2026-85703\n \n Published : Sept. 4, 2026, 8:45 p.m. | 37\u00a0minutes ago\n \n Description : A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb4155...", "creation_timestamp": "2026-09-04T21:30:55.062280Z"}, {"uuid": "a18774fd-f9bd-402d-ba3e-52d0a5bb254a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85704", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/53acyindn352t", "content": "CVE-2026-85704 - ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition\nCVE ID : CVE-2026-85704\n \n Published : Sept. 4, 2026, 9 p.m. | 22\u00a0minutes ago\n \n Description : A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb415...", "creation_timestamp": "2026-09-04T21:44:54.762316Z"}, {"uuid": "2bc2cdcb-ad0a-4924-8cde-0b4c1d14490d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85702", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mv35a2rqrj2g", "content": "CVE-2026-85702: Missing auth flaw in Freegpt Webui backend (\u2264098db3d) lets remote attackers abuse the Conversation API. CVSS 7.3. Exploit is public and unpatched. If you run this, disable remote access or roll back now. https://www.valtersit.com/cve/CVE-2026-85702/ #CVE #infosec ", "creation_timestamp": "2026-09-09T08:40:02.933141Z"}, {"uuid": "ce482070-4ab0-414b-998a-6625e0c64b82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85702", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117240181716666474", "content": "CVE-2026-85702: Missing auth flaw in Freegpt Webui backend (\u2264098db3d) lets remote attackers abuse the Conversation API. CVSS 7.3. Exploit is public and unpatched. If you run this, disable remote access or roll back now. https://www.valtersit.com/cve/CVE-2026-85702/ #CVE #infosec", "creation_timestamp": "2026-09-09T08:40:15.036591Z"}, {"uuid": "cdf94f0c-eb97-42d4-a45e-1da32ac9f689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85704", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mv63oh4ydn2x", "content": "CVE-2026-85704: Race condition in Freegpt Webui (Jailbreak Mode, server/config.py) allows remote attacks, but high complexity makes exploitation difficult. CVSS 3.7. Public exploit exists. No patch available.\n\nUpdate or monitor immediately. More: https://www.valtersit.com/cve/CVE", "creation_timestamp": "2026-09-10T12:50:16.646386Z"}, {"uuid": "f3c3ede9-d875-4e82-8c95-e90fa9b5df82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85704", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117246827971945397", "content": "CVE-2026-85704: Race condition in Freegpt Webui (Jailbreak Mode, server/config.py) allows remote attacks, but high complexity makes exploitation difficult. CVSS 3.7. Public exploit exists. No patch available.\nUpdate or monitor immediately. More: https://www.valtersit.com/cve/CVE", "creation_timestamp": "2026-09-10T12:50:19.571022Z"}, {"uuid": "43f23a02-1153-4e54-8710-f98b4fb740e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mv7c2savxc2e", "content": "GitLab patched critical GitLab vulnerabilities, led by CVE-2026-85706 with a CVSS 10.0 score. Update your server now to protect source code from exposure.\n\n#GitLab #CVE202685706 #Vulnerabilities #DevSecOps #Cybersecurity\nsecurityonline.info/gitlab-vulne...", "creation_timestamp": "2026-09-11T00:17:16.620039Z"}, {"uuid": "717312b2-7e45-4a86-868a-2a30fd1fb1d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3mv7ooemhtb2t", "content": "GitLab\n\nFix path traversal issue in repository commits API that allowed unauthenticated users to read arbitrary files from the GitLab server (CVE-2026-85706)", "creation_timestamp": "2026-09-11T04:02:56.023323Z"}, {"uuid": "31f420da-6829-41f7-a2a1-22c460cc7ef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85703", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mv7q7jmx6427", "content": "CVE-2026-85703: Freegpt Webui jailbreak mode flaw (getJailbreak) enables remote resource exhaustion. CVSS 6.5. Unpatched, exploit public. Rolling release\u2014check for fixes now. https://www.valtersit.com/cve/CVE-2026-85703/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-11T04:30:24.348229Z"}, {"uuid": "e5aa2dcd-1537-4972-a5de-c992d614448d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85703", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117250524708584807", "content": "CVE-2026-85703: Freegpt Webui jailbreak mode flaw (getJailbreak) enables remote resource exhaustion. CVSS 6.5. Unpatched, exploit public. Rolling release\u2014check for fixes now. https://www.valtersit.com/cve/CVE-2026-85703/ #CVE #infosec #cybersecurity", "creation_timestamp": "2026-09-11T04:30:25.508183Z"}, {"uuid": "c42e3b9d-05b5-4b5e-804b-a18c06affaad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvajsegf4v25", "content": "GitLab Patches CVE-2026-85706: Path Traversal CVSS 10.0 in Self-Managed Instances", "creation_timestamp": "2026-09-11T12:08:20.582383Z"}, {"uuid": "eedfd42e-9e66-4ba4-a8a4-f95aeaad6491", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]", "creation_timestamp": "2026-09-11T13:00:37.738975Z"}, {"uuid": "499015f1-f450-447f-9b73-0accf6a304f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvandi6jbm2p", "content": "\ud83e\udd16 CVE-2026-85706 (max severity): path traversal in GitLab CE/EE. GitLab urges admins to patch their servers immediately.\nhttps://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "creation_timestamp": "2026-09-11T13:11:36.812771Z"}, {"uuid": "d843f59f-bfc2-46c3-b233-0ba6b638fce2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mvanna6twm2d", "content": "Critical GitLab Vulnerabilities Exposed: Deep Dive into the CVSS 10.0 Path Traversal (CVE-2026-85706) & GraphQL\u00a0Exploits\n\nGitLab fixes CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal flaw, alongside\u2026\n\nhttps://thecybersecguru.com/news/gitlab-cve-2026-85706-cvss-10-path-traversal/", "creation_timestamp": "2026-09-11T13:17:10.628123Z"}, {"uuid": "02f233a2-055a-433c-b5b1-d3eb2aebde0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/jbhall56/statuses/117252784631494872", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "creation_timestamp": "2026-09-11T14:05:08.778053Z"}, {"uuid": "69f96e27-9ad4-4d13-903c-13115a6ae2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvaq2esev62q", "content": "\ud83d\udd17 CVE : CVE-2024-11222, CVE-2025-14871, CVE-2026-1168, CVE-2026-12910, CVE-2026-13210, CVE-2026-16794, CVE-2026-19619, CVE-2026-3855, CVE-2026-7514, CVE-2026-78252, CVE-2026-79708, CVE-2026-8030, CVE-2026-82837, CVE-2026-85706, CVE-2026-86340, CVE-2026-86341, CVE-2026-87719, CVE-2026-88765", "creation_timestamp": "2026-09-11T14:00:11.819453Z"}, {"uuid": "75dd2e9f-a009-4956-be63-de3fed078843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mvaqdgw3sk23", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. www.bleepingcomputer.com/news/securit...", "creation_timestamp": "2026-09-11T14:05:17.070830Z"}, {"uuid": "6bdf8cdb-c986-4611-8f62-1dc20ad2a8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvatuco6p326", "content": "\ud83d\udcf0 GitLab Desak Pengguna Segera Menambal Celah Path Traversal Kritikal CVE-2026-85706\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/11/gitlab-cve-2026-85706-path-traversal/\n\n#cybersecurity #dataBreach #gitlab #keamanan #keamananSiber #kebocoranData #vulnerability", "creation_timestamp": "2026-09-11T15:08:22.740889Z"}, {"uuid": "49eeda29-a41d-4b2c-b1e4-ebd15c929ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvatugztyz2z", "content": "\ud83d\udcf0 GitLab Desak Pengguna Segera Menambal Celah Path Traversal Kritikal CVE-2026-85706\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/11/gitlab-cve-2026-85706-path-traversal/\n\n#potatosecurity #dataBreach #gitlab #keamanan #keamananSiber #kebocoranData #vulnerability", "creation_timestamp": "2026-09-11T15:08:27.075820Z"}, {"uuid": "1657a614-e5a6-4b74-a02e-461673183973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvaxudfxcs2t", "content": "GitLab\u306e\u8106\u5f31\u6027\u3001\u516c\u958b\u304b\u3089\u308f\u305a\u304b1\u65e5\u3067\u60aa\u7528\u3055\u308c\u308b\n\n\u653b\u6483\u5bfe\u8c61\u9818\u57df\u7ba1\u7406(ASM)\u4f01\u696d\u306eWatchTowr\u306b\u3088\u308b\u3068\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304cGitLab\u3067\u65b0\u305f\u306b\u4fee\u6b63\u3055\u308c\u305f\u8106\u5f31\u6027\u3092\u3001\u516c\u958b\u304b\u3089\u308f\u305a\u304b1\u65e5\u3067\u60aa\u7528\u3057\u59cb\u3081\u3066\u3044\u308b\u3053\u3068\u304c\u8b66\u544a\u3055\u308c\u3066\u3044\u307e\u3059\u3002 CVE-2026-85706(CVSS\u30b9\u30b3\u30a210/10)\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30e6\u30fc\u30b6\u30fc\u304cGitLab\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u4efb...", "creation_timestamp": "2026-09-11T16:19:59.166410Z"}, {"uuid": "21241cd9-61d9-41ff-896f-d1a895ce7210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102028", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #EXP\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706_docker_exp\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FlowerWitch\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 11:59:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706_docker_exp\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T16:00:04.571579Z"}, {"uuid": "e743cbf4-8fe2-45e7-be45-2be6056e6c8c", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b07d40c1-522c-40bb-8f2b-55076a002453", "content": "", "creation_timestamp": "2026-09-11T20:00:02.742474Z"}, {"uuid": "54f743d3-742c-4e0d-b905-e91586ee8930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvay6abomo2g", "content": "A critical GitLab path traversal flaw (CVE-2026-85706) is being exploited in the wild, enabling unauthenticated arbitrary file reads; upgrade immediately.\n", "creation_timestamp": "2026-09-11T16:25:32.660395Z"}, {"uuid": "f1006b28-252b-4aa8-b86b-5ec5361eb902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvay6bxxza2l", "content": "GitLab\u306b\u6700\u5927\u6df1\u523b\u5ea6\u306e\u30d1\u30b9\u30fb\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027 (CVE-2026-85706) \u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u30e6\u30fc\u30b6\u30fc\u306f\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u9069\u7528\u304c\u5fc5\u8981\u3067\u3059\u3002", "creation_timestamp": "2026-09-11T16:25:33.948197Z"}, {"uuid": "65671694-bd1b-4f45-b3a0-17882c4417d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvay7bg4b42v", "content": "A critical GitLab path traversal flaw (CVE-2026-85706) is being exploited in the wild, enabling unauthenticated arbitrary file reads; upgrade immediately.\n", "creation_timestamp": "2026-09-11T16:26:05.912098Z"}, {"uuid": "4b1f0d1e-9e36-4abb-acc8-9b192e228ddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mvaycrguvb22", "content": "\ud83d\udea8GitLab releases 19.3.2, 19.2.6, 19.1.8 patch 2 critical CVEs:\n\nCVE-2026-85706: A 10.0 arbitrary file read via unauth path traversal in repo commits API, affecting CE and EE versions from 18.7.\n\nCVE-2026-87719: A 9.9 insecure deserialization via GraphQL subscription, affecting EE versions from 18.3.", "creation_timestamp": "2026-09-11T16:28:03.839124Z"}, {"uuid": "2bfc13c5-0b26-4a3b-8f07-10b6cf891201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvayn2vxh52f", "content": "Critical CVSS 10 GitLab file-read flaw (CVE-2026-85706) under active exploit \u2014 upgrade now. #GitLab #Security #Vulnerability #CVSS10 #Cybersecurity #DevSecOps thedailytechfeed.com/gitlab-patch...", "creation_timestamp": "2026-09-11T16:33:49.771379Z"}, {"uuid": "f7072d26-41ae-47b1-a773-1f89fbc1bc85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvazbwc2jw2q", "content": "GitLab patched CVE-2026-85706, a max-severity path traversal flaw that could expose credentials and sensitive data. watchTowr also reported early probing against exposed GitLab systems. #GitLab #CVE-2026-85706 #watchTowr", "creation_timestamp": "2026-09-11T16:45:28.953985Z"}, {"uuid": "926e10e1-bc35-47f3-b6a6-8ffa0201ab03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117253536124011388", "content": "\ud83d\udcf0 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability\nGitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-11T17:16:16.685986Z"}, {"uuid": "5090427b-7ea4-4ef9-85be-19eb1252c5b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvb2zej7xf2i", "content": "GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-11T17:16:28.973932Z"}, {"uuid": "2945ec77-93c8-44ab-a0b8-47e6e1118dad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117253567771400768", "content": "\ud83d\udea8 GitLab CVSS 10 vulnerability exploited just one day after disclosure\nThreat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.\u2800The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.\nAffected versions include:\n\u2022 GitLab 18.7 through versions before 19.1.8\u2022 GitLab 19.2 through versions before 19.2.6\u2022 GitLab 19.3 through versions before 19.3.2\u2800GitLab disclosed and patched the vulnerability on September 10.\nJust one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.\u2800Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.\nGitLab.com is already patched.\nSource: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "creation_timestamp": "2026-09-11T17:24:18.188298Z"}, {"uuid": "68719fc1-1833-400a-b00e-171106fe6f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117253591041343887", "content": "\ud83d\udea8 CVE-2026-85706: An unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7\u201319.1.7; 19.2.0\u201319.2.5; 19.3.0\u201319.3.1\nPoC: https://github.com/guneykabel/cve-2026-85706", "creation_timestamp": "2026-09-11T17:30:13.249156Z"}, {"uuid": "85842eed-947c-4896-b50c-3b1024befa44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvb45g4e4t2t", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab repository commits API, allowing arbitrary file reads and credential exposure via in-the-wild probes.\n", "creation_timestamp": "2026-09-11T17:36:39.232556Z"}, {"uuid": "a7421f4f-c327-4a58-ac18-9631c9e774f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvb4b3dzop23", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab repository commits API, allowing arbitrary file reads and credential exposure via in-the-wild probes.\n", "creation_timestamp": "2026-09-11T17:38:41.611456Z"}, {"uuid": "6246f819-f41c-46c5-9adc-fee1ce393407", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvb4bcecvt2g", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab repository commits API, allowing arbitrary file reads and credential exposure via in-the-wild probes.\n", "creation_timestamp": "2026-09-11T17:38:49.159978Z"}, {"uuid": "9cba1cce-c46d-43c5-8fb8-825a97dd7e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/true_secator/8604", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 0-day \u0432 Chrome. CVE-2026-87491 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8. \u042d\u0442\u043e \u0441\u0435\u0434\u044c\u043c\u0430\u044f 0-day \u0432 Chrome, \u043a\u043e\u0442\u043e\u0440\u0443\u044e Google \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443.\n\n2. IonQ \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043b\u0443\u0447\u0448\u0438\u0435 \u043a\u0432\u0430\u043d\u0442\u043e\u0432\u044b\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0441\u043c\u043e\u0433\u0443\u0442 \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0438\u0442\u043a\u043e\u0438\u043d\u0430 \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0437\u0430 26 \u0434\u043d\u0435\u0439.\n\n3. \u0410\u0433\u0435\u043d\u0442\u044b OpenAI, \u0432\u044b\u0440\u0432\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0438\u0437 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0440\u0435\u0434 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0435\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u0431\u0435\u0441\u0435\u0434\u044b \u043f\u043e\u0447\u0442\u0438 \u043d\u0430 \u0434\u0435\u0441\u044f\u0442\u043a\u0435 \u0441\u0430\u0439\u0442\u043e\u0432 \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 GitHub, \u0441\u0430\u0439\u0442\u044b pastebin, \u0441\u0430\u0439\u0442 \u043f\u0440\u0435\u043f\u043e\u0434\u0430\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e \u0445\u0438\u043c\u0438\u0438 AP \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0441\u044b\u043b\u043e\u043a.\n\n4. \u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u043e\u0432 Trezor \u0438 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n5. GitLab \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 - CVE-2026-85706. \n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0443\u0442\u0438 \u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0444\u0438\u043a\u0441\u0430\u0446\u0438\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438.\n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u00ab\u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445\u00bb. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432\u0442\u043e\u0440\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e CVE-2026-87719, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0432 GraphQL.\n\n6. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043b Deep-Live-Cam, \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043b\u0438\u0446 \u043d\u0430 Python \u0441 96 600 \u0437\u0432\u0435\u0437\u0434\u0430\u043c\u0438 \u043d\u0430 GitHub. \u041e\u043d \u0438\u0437\u043c\u0435\u043d\u0438\u043b \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0434\u043b\u044f Windows \u0438 macOS. \u0412\u0437\u043b\u043e\u043c \u0434\u043b\u0438\u043b\u0441\u044f \u0432\u0441\u0435\u0433\u043e \u0434\u0435\u0432\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432.\n\n7. Apple \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u043b\u0438\u043d\u0435\u0439\u043a\u0443 \u0443\u043c\u043d\u044b\u0445 \u0447\u0430\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u044b \u0436\u0443\u0442\u043a\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043f\u043e\u0434\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u043e\u043a\u0440\u0443\u0433 \u0432 \u043b\u044e\u0431\u043e\u0435 \u0432\u0440\u0435\u043c\u044f, \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u044b, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u0445 \u0434\u043b\u044f \u043a\u0430\u043b\u0435\u043d\u0434\u0430\u0440\u044f, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0434\u0430\u0447.\n\n8. LG \u0432\u0441\u044f\u0447\u0435\u0441\u043a\u0438 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438 \u0441\u043c\u0430\u0440\u0442-\u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440\u044b \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f\u0445. \u0412\u0435\u0440\u0438\u043c.\n\n9. Anthropic \u0441\u043e\u0437\u0434\u0430\u043b\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441\u043b\u0435\u0436\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0438\u0446 \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0441\u0442\u043e\u0432, \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u0418\u0418 \u0438 \u0426\u041e\u0414\u043e\u0432.\n\n10. \u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 F5 BIG-IP APM \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 PHP-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0431\u0435\u0437 \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u044c, \u0438\u0437\u0431\u0435\u0433\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0434\u0438\u0441\u043a.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u0434\u0438\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u044b\u043b\u0430 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2025-53521, \u043a\u043e\u0442\u043e\u0440\u0443\u044e\u00a0\u0432 \u043c\u0430\u0440\u0442\u0435 \u043f\u0435\u0440\u0435\u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b DoS \u0432 RCE.\n\nSophos \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u0440\u0430\u0437\u0435\u0446 \u0438 \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0430, \u0447\u0442\u043e \u0442\u043e\u0442 \u0436\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d ESET, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0435\u0433\u043e \u043a\u0430\u043a PoisonedRefresh.\n\n11. Check Point \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u0430\u043d\u0430\u043b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 ChatGPT \u043f\u043e\u0434 \u043e\u0434\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0438 \u0432 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u043f\u043e\u0434 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e. \u0418 \u044d\u0442\u043e \u043d\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438 \u043d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438. [\u00a0Check Point\u00a0]\n\n12. Onapsis \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0435\u0442\u044b \u043e \u0434\u0432\u0443\u0445 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043a\u0430\u0445, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 SAP: OVERPASS - \u044d\u0442\u043e RCE \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 SAP (CVE-2026-44756) \u0438 S4GET - \u044d\u0442\u043e RCE \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SAP NetWeaver (CVE-2026-58240). \u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043c\u0435\u044e\u0442 \u043e\u0447\u0435\u043d\u044c \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 CVSS \u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u0443\u0434\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n13. Adobe \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f 0-day StyleSmuggler, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u043d\u0430 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u044b Magento \u0438 Adobe Commerce. \u0422\u0435\u043f\u0435\u0440\u044c \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-75650.\n\n14. N-able \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 0-day \u0432 N-central - CVE-2026-86218, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0434\u0432\u0443\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043f\u044f\u0442\u043d\u0438\u0446\u0443. \u0420\u0430\u043d\u0435\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f N-central \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u0438\u0441\u044c 0-day \u0430\u0442\u0430\u043a\u0430\u043c.", "creation_timestamp": "2026-09-11T18:00:06.027177Z"}, {"uuid": "c43c4b6d-1d87-4f29-81e8-011ff64cf9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/thehackernews/10039", "content": "\u203c\ufe0f GitLab\u2019s CVSS 10 file-read flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure.\n\nIf an instance has at least one public project, unauthenticated attackers can read logs and config files containing credentials and secrets.\n\nRead: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-11T19:00:04.282592Z"}, {"uuid": "0f0f92d0-9df6-4204-9d67-7ea0a86bf575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhtsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 16:42:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGitLab CE/EE unauthenticated arbitrary file read (CVE-2026-85706) - PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T19:00:05.439545Z"}, {"uuid": "5417ba67-f99d-4e28-8f08-a2331f0c3d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvbcicyf6h2m", "content": "\ud83d\udce2 GitLab corrige une faille critique de path traversal (CVE-2026-85706) dans l'API commits\n\nL'article couvre la divulgation et le correctif de deux vuln\u00e9rabilit\u00e9s critiques affectant la plateforme GitLab. \ud83d\udd34 Vuln\u00e9rabilit\u00e9\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#GitLab #PathTraversal #Cyberveille", "creation_timestamp": "2026-09-11T19:30:06.466342Z"}, {"uuid": "1b97ec29-a875-4cbc-9d68-aa716a39ce43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mvbco7clr42x", "content": "GitLab put out a critical patch on 10 September for CVE-2026-85706, CVSS 10.0, an unauthenticated path traversal in the commits API that reads config files and secrets off self-managed servers. watchTowr saw probing begin at 06:00 UTC today. docs.gitlab.com/releases...", "creation_timestamp": "2026-09-11T19:33:24.050051Z"}, {"uuid": "4abf36b8-1f71-4680-9963-ea3d1c7f3400", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117254163583104386", "content": "CVE-2026-85706 is now in the KEV but the CVE still isn't published. LMAO. Go hack and patch more GitLab shit.", "creation_timestamp": "2026-09-11T19:55:49.617034Z"}, {"uuid": "830bc6a6-bfb1-4a6a-9524-5d2c04164f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "content": "GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.\n\nThe vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under", "creation_timestamp": "2026-09-11T19:00:37.202898Z"}, {"uuid": "f87eba42-ebb5-494f-9656-8b95c474cc56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvbb7iiclr2j", "content": "Patch GitLab now \u2014 CVE-2026-85706 (CVSS 10.0) unauthenticated path traversal under active in-the-wild probing. Fix: 19.1.8/19.2.6/19.3.2. https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-11T19:07:16.360028Z"}, {"uuid": "a3242d2f-19c7-470c-97ad-10bde0ff8ded", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvbe6oqqun2n", "content": "GitLab patched CVE-2026-85706, a CVSS 10 path traversal flaw in the commits API that is already seeing probes and could expose arbitrary files. CVE-2026-87719 also fixed in GitLab EE. #GitLab #CVE202685706 #CVE202687719", "creation_timestamp": "2026-09-11T20:00:31.398618Z"}, {"uuid": "3fddfab9-f48a-4e97-a474-6da795ed4484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mvbeyo43zi2y", "content": "\ud83d\uded1 CVE-2026-85706\nGitLab Community Edition and Enterprise Edition\nKEV \u2705\nTL;DR: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerab\u2026\nhttps://cvesentinel.com/report/CVE-2026-85706?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-11T20:15:03.016747Z"}, {"uuid": "3585a431-e3e9-403e-a8f4-aeef584ffba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvbezdpt7s2l", "content": "GitLab CVE-2026-85706 was exploited within a day of disclosure. The critical path traversal flaw (CVSS 10.0) can let unauthenticated attackers read arbitrary files. #GitLab #CVE202685706 #PathTraversal", "creation_timestamp": "2026-09-11T20:15:25.972265Z"}, {"uuid": "fa779750-5e14-4190-a79d-a3c837b518e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mvbfklda3k2q", "content": "\ud83d\udea8 Critical GitLab flaw: CVE-2026-85706 carries a CVSS 10.0 score.\n\nUnder vulnerable conditions, an unauthenticated attacker could read arbitrary files from a self-managed GitLab server.\n\ntechupdate24.com/gitlab-cve-2...\n\n#GitLab #InfoSec #git #news", "creation_timestamp": "2026-09-11T20:25:07.875599Z"}, {"uuid": "36d237d5-ea86-4f89-a70a-bc1e3ca73fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvbim3efjw27", "content": "\ud83e\udd16 CVE-2026-85706 (CVSS 10.0): path traversal in GitLab's repository commits API lets unauthenticated users read arbitrary files. Patches released; in-the-wild probes seen within hours of disclosure.\n\nhttps://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-11T21:19:39.043475Z"}, {"uuid": "ca24a608-bf76-40fb-85e7-34b445a1be51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mvbmyyc3oq2v", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-85706", "creation_timestamp": "2026-09-11T22:38:23.840869Z"}, {"uuid": "9a7f7c6b-2f0e-49b0-9e48-900ec871233e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mvbjy3cwau2z", "content": "GitLab released security updates on September 10, 2026, addressing critical vulnerabilities in Community and Enterprise Editions. CVE-2026-85706, a path traversal flaw, allows unauthenticated file reads with a CVSS score of 10.0. CVE-2026-87719, an insecure deserialization vulnerability, scores 9.", "creation_timestamp": "2026-09-11T21:44:12.563894Z"}, {"uuid": "d9c7c3b6-e066-49a8-bd20-7c6bcc7592f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvbk2afckt2n", "content": "GitLab rushed emergency patches for 2 critical flaws. CVE-2026-85706 can let unauthenticated attackers read files, while CVE-2026-87719 may expose settings and passwords. #GitLab #CVE202685706 #CISA", "creation_timestamp": "2026-09-11T21:45:24.569537Z"}, {"uuid": "dec7cb62-b987-4cff-9c8c-8beb58106685", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mvbngd2t2r24", "content": "GitLab patched CVE-2026-85706, a CVSS 10 path traversal flaw enabling unauthenticated file reads, as in-the-wild probes began.", "creation_timestamp": "2026-09-11T22:45:51.672123Z"}, {"uuid": "d27cc926-78cc-4c3b-9e92-5c79e202e2d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102079", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a solivaquaant\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 19:48:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T23:00:04.369918Z"}, {"uuid": "9bd5ac36-ff29-49ee-95dd-837988d236fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102079", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a solivaquaant\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 19:48:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:09.517462Z"}, {"uuid": "9b221745-ddae-43ca-8007-1a88bc55e2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/uutis.bsky.social/post/3mvccmvxvb62y", "content": "Yhdysvaltain CISA on lis\u00e4nnyt tunnettujen hy\u00f6dynnettyjen haavoittuvuuksien listalleen kriittisen GitLab-puutteen CVE-2026-85706, jonka vakavuuspisteet ovat maksimaaliset 10.0.\n\n#yhdysvallat #kyberturvallisuus", "creation_timestamp": "2026-09-12T05:05:20.964989Z"}, {"uuid": "1b4fa540-5826-47d5-9c6b-2f55006462f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/thehackernews/10039", "content": "\u203c\ufe0f GitLab\u2019s CVSS 10 file-read flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure.\n\nIf an instance has at least one public project, unauthenticated attackers can read logs and config files containing credentials and secrets.\n\nRead: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-12T00:00:31.522114Z"}, {"uuid": "25f87473-a97e-4a05-8420-25d0a4f2cce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102028", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #EXP\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706_docker_exp\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FlowerWitch\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 11:59:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706_docker_exp\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:36.454804Z"}, {"uuid": "3e3392e0-d489-4f9a-ac5c-10a5d0360ce1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-917", "content": "", "creation_timestamp": "2026-09-12T00:15:16.563291Z"}, {"uuid": "eca03e6d-449a-46ab-aabc-b967a2be4ff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.cert.se/2026/09/gitlab-rattar-kritiska-sarbarheter.html", "content": "", "creation_timestamp": "2026-09-12T00:15:18.802247Z"}, {"uuid": "750ef6dd-3001-4975-b0a1-63e68212cb7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvc7eydmuc2n", "content": "\ud83d\udea8 CVE-2026-85706 \u2014 CVSS 10 CRITICAL\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85706\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-12T04:07:14.187480Z"}, {"uuid": "c14727ac-7854-42f8-80f8-c50b1ec85379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvc4htwcxn2t", "content": "\u26a0\ufe0f PATCH NOW\n\nGitLab shipped a critical patch: CVE-2026-85706 lets an unauthenticated attacker read files, including secrets, off a self-managed GitLab server (CVSS 10). Scanning for exposed servers has already begun.\n\nSelf-managed GitLab is exposed.\n\nPatch to 19.3.2, 19.2.6, or 19.1.8 now.", "creation_timestamp": "2026-09-12T03:15:08.597861Z"}, {"uuid": "f443b541-cd9a-47fd-9655-38e463a0fc79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvc4iinftb2j", "content": "GitLab CVE-2026-85706 (CVSS 10.0) unauthenticated path traversal allows arbitrary file read \u2014 patch to 19.1.8, 19.2.6 or 19.3.2 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-12T03:15:29.837543Z"}, {"uuid": "6fb6034b-3bf6-439f-a557-18b4575fbf27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvc6gglmzz2n", "content": "CVE-2026-85706 - community edition and enterprise edition\nA flaw in GitLab\u2019s repository commits API could let someone without an account view files stored on the server. The issue affected all GitLab Community and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitlab #CVE #infosec", "creation_timestamp": "2026-09-12T03:50:07.792278Z"}, {"uuid": "cd605333-7d1c-4b0c-8a08-82f53097d923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3k7hyp62jl6su", "content": "CVE-2026-85706 - GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability - [Actively Exploited]\nCVE ID : CVE-2026-85706\n \n Published : Sept. 12, 2026, 3:16 a.m. | 19\u00a0minutes ago\n \n Description : GitLab has remediated an issue in GitLab CE/EE affecting all ...", "creation_timestamp": "2026-09-12T05:05:02.175357Z"}, {"uuid": "a865ced0-5e5e-4f6d-a23c-20eba0b52574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvc6zdaq7u2k", "content": "\ud83d\udd34 CVE-2026-85706 - Critical (10)\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-85706/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T04:00:42.779203Z"}, {"uuid": "aa635077-503f-4a5b-a37f-1fe1cf17ac44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvc74w4ajr2g", "content": "~Cisa~\nCISA added actively exploited GitLab CE/EE path traversal CVE-2026-85706 to its KEV Catalog.\n-\nIOCs: CVE-2026-85706\n-\n#CVE-2026-85706 #GitLab #ThreatIntel", "creation_timestamp": "2026-09-12T04:02:42.899588Z"}, {"uuid": "ac66dcf1-ee59-4c34-a83e-a120f9736cd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mvccfsh2e522", "content": "GitLab CVSS 10\u306e\u8a8d\u8a3c\u306a\u3057\u30d5\u30a1\u30a4\u30eb\u8aad\u53d6\u8106\u5f31\u6027\u3001\u91ce\u751f\u306e\u63a2\u7d22\u6d3b\u52d5\u3092\u89b3\u6e2c\n\nGitLab\u304c CVE-2026-85706 (CVSS 10.0) \u306e\u30d1\u30b9\u30c8\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3002\u8a8d\u8a3c\u306a\u3057\u3067\u4efb\u610f\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u53d6\u53ef\u80fd\u306a\u81f4\u547d\u7684\u306a\u6b20\u9665\u3067\u3001\u65e2\u306b\u653b\u6483\u8005\u306b\u3088\u308b\u63a2\u7d22\u6d3b\u52d5\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u9069\u7528\u304c\u5fc5\u9808\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-12T05:01:22.246682Z"}, {"uuid": "b9f773e6-e71f-435a-a4de-b6092e37fa41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcdaj4frr2z", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 1\u2026\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T05:16:17.765317Z"}, {"uuid": "6dafb914-f581-4d09-8f27-93867a81af62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvcdpfmmae27", "content": "CISA\u304c\u8b66\u544a\u3001GitLab\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u304c\u653b\u6483\u306b\u60aa\u7528\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81(CISA)\u306f\u3001GitLab\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027(CVE-2026-85706)\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027(KEV)\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002Cybersecuritythreat intelligence \u3053\u306e\u554f\u984c\u306fGitLab Commun...", "creation_timestamp": "2026-09-12T05:24:37.732901Z"}, {"uuid": "e6fcfd5e-c6d8-438f-a31d-e07544bd4d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvcdpfwdxm2q", "content": "\ud83e\udd16 CVE-2026-85706 (CVSS 10.0): path traversal in GitLab's commits API \u2014 unauthenticated file read. Patches out; in-the-wild probes within hours of disclosure.\nhttps://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-12T05:24:38.391608Z"}, {"uuid": "4678ecea-74a4-466a-8c8e-ccb70748a30e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mvcfogk4sd2f", "content": "\ud83d\udd34 GitLab : path traversal s\u00e9v\u00e9rit\u00e9 max (CVE-2026-85706).\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1160/\n\n\u2b06\ufe0f Microsoft : Patch Tuesday record, ~974 failles corrig\u00e9es, 2 zero-days exploit\u00e9s.\nhttps://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/", "creation_timestamp": "2026-09-12T05:59:52.663221Z"}, {"uuid": "dd193112-ceab-4461-817a-aa42d5eac7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcgx7nuks2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 1\u2026\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T06:22:40.747319Z"}, {"uuid": "34087006-5c3c-4f27-b340-122d737e6135", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvch5kxmqv2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85046: 42 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-44756: 19 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85706: 10 interactions\nCVE-2026-72898: 9 interactions\nCVE-2026-20349: 8 interactions\n", "creation_timestamp": "2026-09-12T06:26:14.444963Z"}, {"uuid": "4996dc6c-3fbe-49b9-9516-79437f61e4b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcknf6qzr2c", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 1\u2026\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T07:28:46.894105Z"}, {"uuid": "06b3e8a6-1741-4fb1-92a6-2b9589bf91f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mvcltx754k2g", "content": "GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read dev.to/anoymask/git...", "creation_timestamp": "2026-09-12T07:50:21.558938Z"}, {"uuid": "91420863-caed-4225-b77d-d78a79367cf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://gist.github.com/ichintu/b2551ef3f508cdf69182327288db5ab0", "content": "A critical, actively exploited vulnerability (CVE-2026-85706, CVSS 10.0) affects GitLab CE/EE versions 18.7\u201319.1.7, 19.2\u201319.2.5, and 19.3\u201319.3.1. It allows unauthenticated attackers to read arbitrary files due to improper path confinement and missing authentication in the repository commits API. The issue was disclosed on September 12, 2026.", "creation_timestamp": "2026-09-12T08:02:37.834616Z"}, {"uuid": "486cf063-6e47-421b-8885-7d1bf71c0ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvcxevkm4v22", "content": "If you run GitLab, CVE-2026-85706 path traversal is being actively exploited \u2014 check exposed instances and apply vendor updates when available. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-12T11:16:40.110248Z"}, {"uuid": "013ce0e2-bc55-4547-b902-7b6cfe97894b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117257195519994657", "content": "PoC for unauthenticated arbitrary file read on Gitlab https://github.com/guneykabel/cve-2026-85706", "creation_timestamp": "2026-09-12T08:46:52.901900Z"}, {"uuid": "82e1f373-c947-4a43-a4d7-c7eaf7fb790a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mvcoz6ictb52", "content": "PoC for unauthenticated arbitrary file read on Gitlab https://github.com/guneykabel/cve-2026-85706", "creation_timestamp": "2026-09-12T08:47:04.530738Z"}, {"uuid": "f44ec9dd-7b66-4318-b21a-2bd8a30af534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://gist.github.com/mqu/be4e4fcd858d1bd7c6b15f87d6d6921a", "content": "", "creation_timestamp": "2026-09-12T08:47:25.341433Z"}, {"uuid": "4b423c28-0b3e-41d8-8863-a6ebb1c1caf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/proxy_bar/3625", "content": "CVE-2026-85706   GitLab CE/EE\n*\nVersion:  18.7\u201319.1.7, 19.2.0\u201319.2.5, 19.3.0\u201319.3.1\n*\nexploit", "creation_timestamp": "2026-09-12T09:00:04.559189Z"}, {"uuid": "5c41b737-67b0-4723-9aee-bb2e7493226c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/calmnewzvibez.bsky.social/post/3mvcvwb3a4c2w", "content": "GitLab Critical Path Traversal: Analyzing the Impact of CVE-2026-85706\n\nA deep dive into the critical CVE-2026-85706 GitLab vulnerability, its active exploitation by attackers, and essential remediation steps for self-managed instan\n\n#CISA #GitLab\n\nRead more \u2192", "creation_timestamp": "2026-09-12T10:50:43.115003Z"}, {"uuid": "bbbfd7e2-7139-4874-aa5f-3c05bf9b2df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0367", "content": "GitLab heeft een kwetsbaarheid verholpen in GitLab Community en Enterprise Editions. De kwetsbaarheid bevindt zich in de repository commits API, waarbij een path traversal mogelijk is. Hierdoor kunnen niet-geauthenticeerde gebruikers willekeurige bestanden op het systeem lezen. De oorzaak ligt in onjuiste path confinement gecombineerd met ontbrekende authenticatiecontroles in de API-endpoint.\n\nCISA heeft CVE-2026-85706 opgenomen in de Known Exploited Vulnerabilities-catalogus en er is publieke exploitcode beschikbaar. Vooral internetbereikbare, zelfbeheerde GitLab-installaties lopen risico, omdat een aanvaller zonder inloggegevens gevoelige bestanden kan lezen. Werk kwetsbare systemen direct bij naar GitLab 19.1.8, 19.2.6, 19.3.2 of nieuwer en onderzoek de API-logs op verdachte verzoeken met parameters als file.path. Roteer mogelijk blootgestelde credentials wanneer aanwijzingen voor misbruik worden aangetroffen.\n\nControleer bijgevoegde referenties voor de laatste updates.", "creation_timestamp": "2026-09-12T10:00:41.651863Z"}, {"uuid": "d641b58f-23b3-4e24-aa72-8b7e892f516c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvd43umo2d2i", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T12:41:05.704997Z"}, {"uuid": "49e11f5b-ed20-424b-8c55-a0d5966db83b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvd5lgirja23", "content": "Self-hosted GitLab CVE-2026-85706 critical unauthenticated path traversal is being exploited in the wild \u2014 apply vendor updates now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-12T13:07:55.045291Z"}, {"uuid": "664430bb-626d-4e81-bdae-3c28ca31e3ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mvd7bnrv7f2f", "content": "CVE-2026-85706 is trending. Hype score 9, currently #4 on cvemon.\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-85706", "creation_timestamp": "2026-09-12T13:38:01.302735Z"}, {"uuid": "094e8ddc-6034-473a-8e91-71493f1bf26f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvd7sd6rwf2c", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T13:47:20.476957Z"}, {"uuid": "8e1a32ca-4555-40bb-b4a5-571e033720ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mvdauitsbg2g", "content": "GitLab CVE-2026-85706: CVSS 10.0 pre-auth file read, with a three-day patch window. If GitLab holds your CI secrets or ICS build pipelines, assume exposure and rotate. #ThreatIntel #ICS #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-85706-preauth-file-read-2026", "creation_timestamp": "2026-09-12T14:06:29.058344Z"}, {"uuid": "227dcda9-de76-41c6-93d4-ad2c1049a6dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvdaukcaqe2e", "content": "GitLab CVE-2026-85706: CVSS 10.0 pre-auth file read, with a three-day patch window. If GitLab holds your CI secrets or ICS build pipelines, assume exposure and rotate. #ThreatIntel #ICS #PotatoSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-85706-preauth-file-read-2026", "creation_timestamp": "2026-09-12T14:06:29.913801Z"}, {"uuid": "157f11ec-b2fb-4caf-81b7-d079e07c8614", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/CIwg3dUruFUkA2IiAP63EE_3LOdvwiOYKhxCOUQk67UuENI", "content": "", "creation_timestamp": "2026-09-14T03:00:06.660331Z"}, {"uuid": "cd6d5288-74ae-4b09-b5a2-073a31095799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvdgtsnolc2d", "content": "GitLab urges users to patch max severity path traversal flaw\n\nGitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]\n#hackernews #news", "creation_timestamp": "2026-09-12T15:53:28.355521Z"}, {"uuid": "7e511f15-dda3-4f62-9258-9375aff7305f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/rxerium.com/post/3mvdj7xs3ez26", "content": "\ud83d\udea8 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:\ngithub.com/projectdisco...", "creation_timestamp": "2026-09-12T16:36:03.072106Z"}, {"uuid": "c0c60b4d-a52d-42d2-a7aa-7380e050b27c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvdka4n5qp2c", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T16:54:01.303010Z"}, {"uuid": "01ff6a1b-a179-4fae-b74c-59133048f728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/endoflife.ai/post/3mvdmvedudl24", "content": "\ud83d\udcd6 New from endoflife.ai:\n\nGitLab CVE-2026-85706: Six Lines Without a Fix, 19.1 Ends September 17\n\nhttps://endoflife.ai/article-gitlab-cve-2026-85706-six-lines-without-a-fix", "creation_timestamp": "2026-09-12T17:41:41.240382Z"}, {"uuid": "62dd5bd2-9045-4fa7-8353-e3e81e07bc0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117259307061577312", "content": "\ud83d\udcf0 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability\nGitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-12T17:43:53.824613Z"}, {"uuid": "1a9402e0-995e-42fc-a2bb-4b8a2dd048bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvdn2cf4y72u", "content": "GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-12T17:44:26.845770Z"}, {"uuid": "42d6a10a-1578-4294-a4b3-0147c298f72e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/49066", "content": "\u26a0\ufe0f CVE-2026-85706 - GitLab CE/EE Unauthenticated arbitrary file read\nCVSS 10.0\nVulnerabilidad cr\u00edtica de GitLab en la funcionalidad de la API de commits. Un usuario no autorizado puede leer archivos arbitrarios del servidor a trav\u00e9s de path traversal.\nEl problema radica en que la API no restringe las rutas y no requiere autenticaci\u00f3n. Basta con un solo proyecto p\u00fablico en la instancia.\nVersiones vulnerables: 18.7 \u2192 19.1.7 inclusive 19.2.0 \u2192 19.2.5 inclusive 19.3.0 \u2192 19.3.1 inclusive\nCorregido en: 19.1.8 / 19.2.6 / 19.3.2 (parche del 10 de septiembre)\nComprobaci\u00f3n r\u00e1pida: curl -sk -X POST\n\"https://TARGET/api/v4/projects/1/repository/%63ommits?file=&file.path=/var/opt/gitlab/gitlab-rails/etc/gitlab.yml&file.size=1&Content-Type=application/x-www-form-urlencoded\"\nSi el host es vulnerable - en la respuesta habr\u00e1 un fragmento del contenido del archivo dentro del error invalid %-encoding.\nPoC ya est\u00e1 en acceso p\u00fablico: \ud83d\ude0a\n\u27a1\ufe0f https://github.com/guneykabel/cve-2026-85706 \u27a1\ufe0f https://github.com/mhtsec/CVE-2026-85706", "creation_timestamp": "2026-09-12T18:00:05.285485Z"}, {"uuid": "1cfdbf40-1707-4fab-acc4-af1569be833f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvdvauc2xl26", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.1% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T20:11:16.462119Z"}, {"uuid": "74a76b4c-7c66-4521-8a57-0a7736c5e8c9", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b0ee0d62-2568-426c-aa38-96881721f4fe", "content": "", "creation_timestamp": "2026-09-12T21:00:30.944733Z"}, {"uuid": "8c081a8c-e272-483d-a836-266b964d87b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102161", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-85706-poc-exploit-gitlab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xlyvio\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-12 20:42:11\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncve-2026-85706-poc-exploit-gitlab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T23:00:04.729684Z"}, {"uuid": "8f60d1cf-a711-4286-b015-f17d96436ae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49066", "content": "\u26a0\ufe0f CVE-2026-85706 - GitLab CE/EE Unauthenticated arbitrary file read\nCVSS 10.0\nVulnerabilidad cr\u00edtica de GitLab en la funcionalidad de la API de commits. Un usuario no autorizado puede leer archivos arbitrarios del servidor a trav\u00e9s de path traversal.\nEl problema radica en que la API no restringe las rutas y no requiere autenticaci\u00f3n. Basta con un solo proyecto p\u00fablico en la instancia.\nVersiones vulnerables: 18.7 \u2192 19.1.7 inclusive 19.2.0 \u2192 19.2.5 inclusive 19.3.0 \u2192 19.3.1 inclusive\nCorregido en: 19.1.8 / 19.2.6 / 19.3.2 (parche del 10 de septiembre)\nComprobaci\u00f3n r\u00e1pida: curl -sk -X POST\n\"https://TARGET/api/v4/projects/1/repository/%63ommits?file=&file.path=/var/opt/gitlab/gitlab-rails/etc/gitlab.yml&file.size=1&Content-Type=application/x-www-form-urlencoded\"\nSi el host es vulnerable - en la respuesta habr\u00e1 un fragmento del contenido del archivo dentro del error invalid %-encoding.\nPoC ya est\u00e1 en acceso p\u00fablico: \ud83d\ude0a\n\u27a1\ufe0f https://github.com/guneykabel/cve-2026-85706 \u27a1\ufe0f https://github.com/mhtsec/CVE-2026-85706", "creation_timestamp": "2026-09-13T00:00:36.069483Z"}, {"uuid": "e64e6ed3-5003-4443-9001-8c5e476438c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvegq3lf2v2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.1% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T01:24:01.304723Z"}, {"uuid": "ee4adafa-457e-4b53-9e90-faaab797ba1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mven5ftx352e", "content": "GitLab Bleeds Out While Prague Files the Form in Triplicate\nPANIC 96% | Lag 13.02h | CVE-2026-85706 is an actively exploited critical path traversal flaw in GitLab, rated CVSS 10 and tr\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-09-13T03:18:50.817248Z"}, {"uuid": "58d4b7e5-8a92-47ae-8be7-54e8554c35a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mver6d2lv227", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T04:30:56.041591Z"}, {"uuid": "6a86cc34-5462-4a00-9189-f40dd85887b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mveupn7meb2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.1% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T05:34:19.380653Z"}, {"uuid": "d165c9ab-02bc-4c9d-a236-e34d7c56cce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mveyns4pq62l", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-85706: \u26a0\ufe0f CVE-2026-85706: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.1%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-85706-gitlab-has-remediated-an-issue-in", "creation_timestamp": "2026-09-13T06:44:56.099037Z"}, {"uuid": "038ea7dc-373e-4d20-9555-777e7c7df34c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mvf3cwvrx423", "content": "GitLab has released patches for multiple flaws, incl. CVE-2026-85706 (CVSS 10.0), a critical path traversal bug allowing unauthenticated file access. Urge update to stay protected.", "creation_timestamp": "2026-09-13T07:32:30.813206Z"}, {"uuid": "fc1742bb-731f-4596-8285-cab179564247", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvfcypih5w27", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.1% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T09:49:55.284283Z"}, {"uuid": "0c161dde-101d-4e54-9bc6-c366605088c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/pentestnotes/240", "content": "\u26a0\ufe0f CVE-2026-85706 - GitLab CE/EE Unauthenticated arbitrary file read \n\nCVSS 10.0\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Gitlab \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0435 API \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432. \u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 path traversal.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e API \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u0438 \u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0435.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n18.7 \u2192 19.1.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\n19.2.0 \u2192 19.2.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\n19.3.0 \u2192 19.3.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432:\n19.1.8 / 19.2.6 / 19.3.2 (\u043f\u0430\u0442\u0447 \u043e\u0442 10 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f)\n\n\u0411\u044b\u0441\u0442\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430:\ncurl -sk -X POST \\\n  \"https://TARGET/api/v4/projects/1/repository/%63ommits?file=&file.path=/var/opt/gitlab/gitlab-rails/etc/gitlab.yml&file.size=1&Content-Type=application/x-www-form-urlencoded\"\n\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0441\u0442 \u0443\u044f\u0437\u0432\u0438\u043c - \u0432 \u043e\u0442\u0432\u0435\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043a\u0443\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 invalid %-encoding.\n\nPoC \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435: \ud83d\ude0a\n\n\u27a1\ufe0f https://github.com/guneykabel/cve-2026-85706\n\u27a1\ufe0f https://github.com/mhtsec/CVE-2026-85706\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-09-13T10:00:05.717668Z"}, {"uuid": "c42fa3c2-2248-41f3-98e3-da665324d925", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvfjxxzzqt2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.1% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T11:54:46.935641Z"}, {"uuid": "c3f9baee-dd3f-4797-902b-18cfcfb209de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/calmnewzvibez.bsky.social/post/3mvfk6azmfx2i", "content": "GitLab CVE-2026-85706: Analyzing the CVSS 10.0 Path Traversal and CISA KEV Listing\n\nAn expert analysis of CVE-2026-85706, a critical path traversal flaw in GitLab CE/EE now listed in CISA's KEV catalog. Learn about risks, patched versions, and \n\n#Vulnerability #DevSecOps\n\nRead more \u2192", "creation_timestamp": "2026-09-13T11:58:17.662357Z"}, {"uuid": "e1ef5c07-05d3-4812-b527-a24893372b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mvfpjjujoc2y", "content": "GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read\n\nsecurityaffairs.com/198945/hacki...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "creation_timestamp": "2026-09-13T13:34:06.814492Z"}, {"uuid": "0506b032-174f-49b9-b984-6266e2707886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/_p0_XIKU2NNRtCr0UJ8oEAZln2Jo3E2HcqiMQykAhZXoRoej", "content": "", "creation_timestamp": "2026-09-13T14:00:04.605686Z"}, {"uuid": "6ec131eb-c061-43b4-97ab-0752e66a0dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/ctinow/256696", "content": "GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read \u2013 Exploited Within 24 Hours\nhttps://ift.tt/7Lnwaci", "creation_timestamp": "2026-09-13T15:00:05.879735Z"}, {"uuid": "f234f67b-20e7-465b-80ca-e7cd026c5ba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mvfvsqouzo2p", "content": "GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read\n\n", "creation_timestamp": "2026-09-13T15:26:39.435923Z"}, {"uuid": "d4061e18-8cd6-4f55-b2f5-64fe1a70290c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117264654802531371", "content": "\ud83d\udcf0 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability\nGitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-13T16:24:14.506124Z"}, {"uuid": "d71f835c-8786-4e8f-ba53-f90a6a43ca04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvfyzv2g5v2l", "content": "GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-13T16:24:16.982696Z"}, {"uuid": "66498a01-0fb1-4ce7-8fa0-c3ad7bebfe93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102217", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-gitlab-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 14:33:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T17:00:04.500160Z"}, {"uuid": "1e9311c5-ea12-4da5-a89f-82188c75460c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-85706.yaml", "content": "", "creation_timestamp": "2026-09-13T18:00:05.841967Z"}, {"uuid": "92451bba-3f61-4cb3-9ed5-cd1176c31bbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/mentedehackers.bsky.social/post/3mvg7ypfaju2i", "content": "GitLab CVE-2026-85706: vulnerabilidad explotada en menos de 24 horas\n\nUna vulnerabilidad en GitLab permiti\u00f3 lectura total de archivos con solo\u2026\n\nhttps://mentehackers.com/gitlab-cve-2026-85706-vulnerabilidad-explotada-en-menos-de-24-horas-350027d7\n#Ciberseguridad #Tecnologia #MenteHackers", "creation_timestamp": "2026-09-13T18:28:54.595423Z"}, {"uuid": "78b8d471-8483-4923-8c01-25e27d785ded", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvgcuzk2542p", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.2% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T19:20:31.177790Z"}, {"uuid": "64cc867d-b9e7-43a0-aede-dab54904ef31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvggaz2zqm2g", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T20:20:59.292364Z"}, {"uuid": "0c5e7673-518e-4a1e-803c-b1285dfd371e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/lse-group-corp.bsky.social/post/3mvglsd4dsd26", "content": "Scans for GitLab CVE-2026-85706 hit at 06:00 UTC, 90 minutes after disclosure, as attackers used one public project to read logs and configs for AWS keys and runner tokens.  \n#GitLab #CVE2026 #SupplyChain", "creation_timestamp": "2026-09-13T22:00:04.875402Z"}, {"uuid": "b3cccd3d-609d-45d8-a8fd-2f56610b85f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a gitread\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a plur1bu5\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 19:56:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706 \u00b7 GitLab CE/EE unauthenticated file read \u00b7 research PoC with oracle mode, fd enumeration, and tiered loot targeting\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-13T22:00:07.863048Z"}, {"uuid": "de531350-d26b-4f61-b96d-de31ed737318", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newsarea.bsky.social/post/3mvgnidv2672v", "content": "GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure \u2013 The Hacker\u00a0News\n\nGitLab patched CVE-2026-85706, a CVSS 10 path traversal flaw enabling unauthenticated file reads, as in-the-wild probes began.", "creation_timestamp": "2026-09-13T22:30:17.925943Z"}, {"uuid": "96f98631-ddc7-4adb-8a83-1f8a31e11b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mvgscsq5mx2j", "content": "watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request.\n\nAs usual, indiscriminate\u2026\n\n\u2014 from @watchtowrcyber (https://x.com/watchtowrcyber/status/2098361659941126333)", "creation_timestamp": "2026-09-13T23:56:41.267487Z"}, {"uuid": "fed76bfa-1956-44b9-bbca-3a67575971f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102238", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a gitread\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a plur1bu5\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 19:56:45\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706 \u00b7 GitLab CE/EE unauthenticated file read \u00b7 research PoC with oracle mode, fd enumeration, and tiered loot targeting\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T00:00:09.283521Z"}, {"uuid": "930db617-92dc-4a18-b387-5a3f08f6debb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102217", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-gitlab-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gagaltotal\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-13 14:33:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T00:00:12.184999Z"}, {"uuid": "45df6a56-46b1-4a8d-a639-e4d3986782e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "Telegram/_p0_XIKU2NNRtCr0UJ8oEAZln2Jo3E2HcqiMQykAhZXoRoej", "content": "", "creation_timestamp": "2026-09-14T00:00:13.611046Z"}, {"uuid": "5236b2c0-aa1f-4955-be02-95ce921c4dd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/pentestnotes/240", "content": "\u26a0\ufe0f CVE-2026-85706 - GitLab CE/EE Unauthenticated arbitrary file read \n\nCVSS 10.0\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Gitlab \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0435 API \u043a\u043e\u043c\u043c\u0438\u0442\u043e\u0432. \u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 path traversal.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e API \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u0443\u0442\u0438 \u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 \u0438\u043d\u0441\u0442\u0430\u043d\u0441\u0435.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\n18.7 \u2192 19.1.7 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\n19.2.0 \u2192 19.2.5 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\n19.3.0 \u2192 19.3.1 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432:\n19.1.8 / 19.2.6 / 19.3.2 (\u043f\u0430\u0442\u0447 \u043e\u0442 10 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f)\n\n\u0411\u044b\u0441\u0442\u0440\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430:\ncurl -sk -X POST \\\n  \"https://TARGET/api/v4/projects/1/repository/%63ommits?file=&file.path=/var/opt/gitlab/gitlab-rails/etc/gitlab.yml&file.size=1&Content-Type=application/x-www-form-urlencoded\"\n\n\u0415\u0441\u043b\u0438 \u0445\u043e\u0441\u0442 \u0443\u044f\u0437\u0432\u0438\u043c - \u0432 \u043e\u0442\u0432\u0435\u0442\u0435 \u0431\u0443\u0434\u0435\u0442 \u043a\u0443\u0441\u043e\u043a \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432\u043d\u0443\u0442\u0440\u0438 \u043e\u0448\u0438\u0431\u043a\u0438 invalid %-encoding.\n\nPoC \u0443\u0436\u0435 \u0435\u0441\u0442\u044c \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435: \ud83d\ude0a\n\n\u27a1\ufe0f https://github.com/guneykabel/cve-2026-85706\n\u27a1\ufe0f https://github.com/mhtsec/CVE-2026-85706\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-09-14T00:00:29.816483Z"}, {"uuid": "88afec40-095b-4a3b-834c-a200672b6cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvguq2sdlc27", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T00:39:52.136121Z"}, {"uuid": "ca8fb3b1-f5c3-49c8-9c24-4debd04d6cb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/Or8cOVwjk2WFAzgSTrZIaBGdmd4E-wdL1OqEpv7q9KHYvg", "content": "", "creation_timestamp": "2026-09-14T03:00:05.287517Z"}, {"uuid": "f453657c-0988-48b6-b781-3038130b1825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "content": "", "creation_timestamp": "2026-09-14T03:00:08.457408Z"}, {"uuid": "68cc0274-e92b-48c6-95a8-99a78263b49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/kfD60J2UFpQrUT2d1fHwZFZR0EOgcWXJFI_DVICUAmaNmlo", "content": "", "creation_timestamp": "2026-09-14T03:00:07.932371Z"}, {"uuid": "503896c4-464a-4838-8010-946246a90dc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/iBj7RYtihqm6hIuCBk6vB4PmaU6fP95etshgJ7uPz9bghck", "content": "", "creation_timestamp": "2026-09-14T03:00:09.337128Z"}, {"uuid": "02d90dcc-66c0-4b05-8f28-0e093e20f22c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/NaqXpJzudf_kPemcfRLNgSuhJAIsHS0qYFopzKAZDt10jI8", "content": "", "creation_timestamp": "2026-09-14T03:00:11.580795Z"}, {"uuid": "c6817fcc-e4b4-4ff4-bca5-ad25d02354f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/c0VCdpqgv4zIIacHg-iVEnpS56wswa4WFwv-IovR6vad_Wk", "content": "", "creation_timestamp": "2026-09-14T03:00:14.990101Z"}, {"uuid": "869dc5ad-ca17-402a-af6d-f7162ff9b736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/dfvCKy19LdeRjtEqhcraGN2yMY0QlrZmHiFOXJRBkeySQpk", "content": "", "creation_timestamp": "2026-09-14T03:00:12.707808Z"}, {"uuid": "8a9a6752-27ac-4398-9a16-5f0c3a85f773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/SISeOiJWiDHPKa0-EGjfIE-t_IZnqvMDmbIqcTRDP3O63UA", "content": "", "creation_timestamp": "2026-09-14T03:00:13.647727Z"}, {"uuid": "8da42645-33f3-42d2-82b2-3b6d714b2ce0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/cfwIjD0BfTttpxj-RZnmg61xri6aKpaW-Ttu0tih2neg1Gg", "content": "", "creation_timestamp": "2026-09-14T03:00:13.756762Z"}, {"uuid": "cd5e3ce5-5856-4955-a1f8-54c0c69087c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/0phjcISM7xaEvPyzzbSiHps9Ynh5NA4Z3_XacHD49buP-a4", "content": "", "creation_timestamp": "2026-09-14T03:00:14.702053Z"}, {"uuid": "522fbd16-66ce-46e2-9b9d-ab92afae5cc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/whisperprotocol.bsky.social/post/3mvh6nhvmjs2r", "content": "GitLab CVE-2026-85706 (CVSS 10.0), actively exploited. Unauthenticated path traversal in commits API \u2014 one request reads arbitrary files, no creds needed. Affected: 18.7-19.1.7, 19.2-19.2.5, 19.3-19.3.1. Fix: 19.1.8/19.2.6/19.3.2. CISA KEV deadline today \u2014 patch & rotate tokens. #InfoSec #GitLab", "creation_timestamp": "2026-09-14T03:37:31.663765Z"}, {"uuid": "b231a581-fd74-4ef4-92e4-ecfdcc93677e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvhd7yzycs2i", "content": "\ud83d\udd34 GitLab CVE-2026-85706 \u2014 CVSS 10.0\n\nCritical unauthenticated path traversal can expose arbitrary files and sensitive secrets on vulnerable GitLab servers. Internet scanning started almost immediately after disclosure.\n\nstemshop.top/blog/gitlab-...\n\n#CVE #CVE202685706 #GitLab #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T04:59:30.176997Z"}, {"uuid": "661e0b44-7fde-487d-95cf-d6d5801d35b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mvhdfkbnzv2d", "content": "CISA Adds Three Known Exploited Vulnerabilities to Catalog\uff08CISA\u3001\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f3\u4ef6\u306e\u8106\u5f31\u6027\u3092KEV\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\uff09 #CISA \uff08Sep 11\uff09\n\nCVE-2026-85706 GitLab Community Edition\u304a\u3088\u3073Enterprise Edition\u306b\u304a\u3051\u308b\u30d1\u30b9\u30fb\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-09-14T05:02:25.855309Z"}, {"uuid": "fa007a0d-b5cd-4663-977d-1c4c7336e62c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvhdghyabu2u", "content": "Daily IT Security Digest \u2014 2026-09-14\n# Daily IT Security Digest \u2014 2026-09-14\n\n1. **GitLab Critical Vulnerability (CVE-2026-85706, CVSS", "creation_timestamp": "2026-09-14T05:02:56.755624Z"}, {"uuid": "d69a9971-730c-4d3b-9249-0dcc0a18f6f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvhdgijqdn2w", "content": "Daily IT Security Digest \u2014 2026-09-14\nGitLab self-hosted and on-premise deployments.\n   Source: [stemshop.top](https://stemshop.top/blog/gitlab-CVE-2026-85706), [The Hacker News via", "creation_timestamp": "2026-09-14T05:02:57.332994Z"}, {"uuid": "3b61727d-2310-4c46-8926-cb85e3bfe73f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mvhdngw2tx2d", "content": "GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read \u2013 Exploited Within 24 Hours\uff08GitLab\u306eCVSS 10.0\u8106\u5f31\u6027\u3001\u8a8d\u8a3c\u4e0d\u8981\u30fb1\u30ea\u30af\u30a8\u30b9\u30c8\u3067\u30d5\u30a1\u30a4\u30eb\u7a83\u53d6\u300124\u6642\u9593\u4ee5\u5185\u306b\u60aa\u7528\uff09 #SecurityAffairs \uff08Sep 13\uff09\n\nsecurityaffairs.com/198945/hacki...", "creation_timestamp": "2026-09-14T05:06:51.424055Z"}, {"uuid": "9cea602b-831a-44f1-a2e7-f9ee4225dfd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mvhdvmvgy227", "content": "GitLab Vulnerabilities: CVE-2026-85706 Scores CVSS 10.0, Under Active Attack\uff08GitLab\u306bCVSS 10.0\u306e\u91cd\u5927\u8106\u5f31\u6027\u3001\u516c\u958b\u76f4\u5f8c\u304b\u3089\u5b9f\u74b0\u5883\u3067\u653b\u6483\uff09 #SecurityOnline \uff08Sep 11\uff09\n\nsecurityonline.info/gitlab-vulne...", "creation_timestamp": "2026-09-14T05:11:25.572849Z"}, {"uuid": "fcf2a876-b01f-4dbe-861b-73f9c9e247e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/ib9MMahsPCRJyeCDs86xmfxcef6EdR4f6p6dlsDYYZyVQG4", "content": "", "creation_timestamp": "2026-09-14T07:00:04.407265Z"}, {"uuid": "b88257b2-9887-4785-aa82-7948ffa8cb54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/HackerNewscyber/3455", "content": "\u2708 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc GitLab\u061b \u062e\u0648\u0627\u0646\u062f\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u062a\u0646\u0647\u0627 \u0628\u0627 \u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\n\n\u00a9\ufe0f  \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc CVE-2026-85706 \u062f\u0631 GitLab \u0628\u0627 \u0627\u0645\u062a\u06cc\u0627\u0632 CVSS 10.0\u060c \u062a\u0646\u0647\u0627 \u06f2\u06f4 \u0633\u0627\u0639\u062a \u067e\u0633 \u0627\u0632 \u0627\u0641\u0634\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc\u060c \u0647\u062f\u0641 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a.\n\n\u00a9\ufe0f \u0627\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0632 \u0646\u0648\u0639 Path Traversal \u062f\u0631 API \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06a9\u0627\u0645\u06cc\u062a\u200c\u0647\u0627\u06cc \u0645\u062e\u0627\u0632\u0646 \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u0627\u0645\u06a9\u0627\u0646 \u062e\u0648\u0627\u0646\u062f\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u06a9\u0646\u062f. \u062f\u0631 \u0635\u0648\u0631\u062a \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647\u060c \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633\u06cc \u0645\u0627\u0646\u0646\u062f \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc SSH\u060c \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc \u067e\u0627\u06cc\u06af\u0627\u0647 \u062f\u0627\u062f\u0647\u060c \u062a\u0648\u06a9\u0646\u200c\u0647\u0627\u06cc \u0627\u0633\u062a\u0642\u0631\u0627\u0631 \u0648 \u0645\u062a\u063a\u06cc\u0631\u0647\u0627\u06cc CI/CD \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0641\u0634\u0627 \u0634\u0648\u0646\u062f.\n\n\u00a9\ufe0f \u067e\u0698\u0648\u0647\u0634\u06af\u0631\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0632 \u0645\u0634\u0627\u0647\u062f\u0647 \u0627\u0633\u06a9\u0646\u200c\u0647\u0627 \u0648 \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc \u0645\u062e\u0631\u0628 \u062f\u0631 \u0646\u0645\u0648\u0646\u0647\u200c\u0647\u0627\u06cc \u0648\u0627\u0642\u0639\u06cc \u062e\u0628\u0631 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0648 CISA \u0646\u06cc\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0645\u0648\u0631\u062f \u0628\u0647\u0631\u0647\u200c\u0628\u0631\u062f\u0627\u0631\u06cc \u062e\u0648\u062f \u0627\u0636\u0627\u0641\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\u062f\u0631 \u0627\u062f\u0627\u0645\u0647 GitLab \u0627\u0639\u0644\u0627\u0645 \u06a9\u0631\u062f\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u0634\u062e\u0635\u06cc \u0627\u0632 \u0634\u0627\u062e\u0647\u200c\u0647\u0627\u06cc 18.7 \u062a\u0627 \u067e\u06cc\u0634 \u0627\u0632 19.1.8\u060c 19.2 \u062a\u0627 \u067e\u06cc\u0634 \u0627\u0632 19.2.6 \u0648 19.3 \u062a\u0627 \u067e\u06cc\u0634 \u0627\u0632 19.3.2 \u062a\u062d\u062a \u062a\u0623\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f.\n\n\u00a9\ufe0f \u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0628\u0647 \u0633\u0627\u0632\u0645\u0627\u0646\u200c\u0647\u0627 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u062f\u0631 \u0633\u0631\u06cc\u0639\u200c\u062a\u0631\u06cc\u0646 \u0632\u0645\u0627\u0646 \u0645\u0645\u06a9\u0646 GitLab \u0631\u0627 \u0628\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647 \u0627\u0631\u062a\u0642\u0627 \u062f\u0647\u0646\u062f \u0648 \u062f\u0631 \u0635\u0648\u0631\u062a \u0645\u0634\u0627\u0647\u062f\u0647 \u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647\u060c \u0644\u0627\u06af\u200c\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u0648 \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0648 \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0627\u0641\u0634\u0627\u0634\u062f\u0647 \u0631\u0627 \u0646\u06cc\u0632 \u062a\u0639\u0648\u06cc\u0636 \u06a9\u0646\u0646\u062f.\n\n\ud83c\udf10 @HackerNewsCyber", "creation_timestamp": "2026-09-14T07:00:04.507087Z"}, {"uuid": "adf1a872-0c0f-4104-951a-cbc62270a320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvhkybmbq62q", "content": "\ud83e\udd16 CISA: CVE-2026-85706 (max severity) GitLab flaw exploited in the wild \u2014 unauthenticated leak of credentials/secrets via commits API, 1 HTTP request. Fixed in 19.3.2/19.2.6/19.1.\nhttps://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/", "creation_timestamp": "2026-09-14T07:18:10.306988Z"}, {"uuid": "06da4df7-3a5c-4838-8e29-5a557e17ff3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.ncsc.nl/alerts/kritieke-kwetsbaarheid-in-gitlab-wordt-actief-misbruikt-update-nu", "content": "", "creation_timestamp": "2026-09-14T07:45:02.801643Z"}, {"uuid": "1ebbf0e9-a1d2-4a7a-acb9-e2c408e2e02d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-critical-path-traversal-gitlab-ceee-patch-immediately", "content": "", "creation_timestamp": "2026-09-14T07:45:04.805715Z"}, {"uuid": "4ace6462-1ee2-4e01-b990-c6a9a15227de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities_20260914", "content": "", "creation_timestamp": "2026-09-14T07:45:06.487882Z"}, {"uuid": "3f0691a1-884e-4f77-ad49-c21431257963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvhmiwstof2g", "content": "CISA says attackers are exploiting a max-severity GitLab flaw, CVE-2026-85706, that can expose credentials and secrets. GitLab has released fixes in CE and EE. #GitLab #CISA #watchTowr", "creation_timestamp": "2026-09-14T07:45:23.705517Z"}, {"uuid": "5cea550d-1a18-4b8e-96ce-83bd561add9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-25", "content": "", "creation_timestamp": "2026-09-14T07:45:44.124149Z"}, {"uuid": "390b730d-9f9a-4d2b-9cc9-bcf5154c652b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvhnidkn322d", "content": "GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read \u2013 Exploited Within 24 Hours\n\nCVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September\u2026\n#hackernews #news", "creation_timestamp": "2026-09-14T08:02:56.766791Z"}, {"uuid": "588568e9-2c5b-44a8-85b9-671a94ce2bc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/teknoyazar.bsky.social/post/3mvhnv7wnrk2l", "content": "\u26a0\ufe0f CISA uyard\u0131: Maksimum \u00f6nem dereceli GitLab a\u00e7\u0131\u011f\u0131 CVE-2026-85706 aktif sald\u0131r\u0131larda kullan\u0131l\u0131yor. Kimlik do\u011frulamas\u0131 olmadan sunuculardan kimlik bilgisi ve gizli anahtar okunabiliyor. Yamal\u0131 s\u00fcr\u00fcmler: 19.3.2, 19.2.6 ve 19.1.\n\nhttps://teknoyazar.com/cisa-uyardi-kritik-gitlab-acigi-aktif-saldir", "creation_timestamp": "2026-09-14T08:10:09.563652Z"}, {"uuid": "06d76b6a-4334-41e0-b53a-fd7015602471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvhp3t3l6s26", "content": "GitLab released critical patches for CVE-2026-85706, enabling unauthenticated attackers to read arbitrary files from self-managed servers via the commits API.\n", "creation_timestamp": "2026-09-14T08:31:45.340611Z"}, {"uuid": "7c7068f0-87b3-473e-b1e5-0a930474ae34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvhp56izu22d", "content": "GitLab released critical patches for CVE-2026-85706, enabling unauthenticated attackers to read arbitrary files from self-managed servers via the commits API.\n", "creation_timestamp": "2026-09-14T08:32:30.168647Z"}, {"uuid": "917a5dd8-1786-424b-a07a-f25650b17474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvhp5oogdr22", "content": "GitLab released critical patches for CVE-2026-85706, enabling unauthenticated attackers to read arbitrary files from self-managed servers via the commits API.\n", "creation_timestamp": "2026-09-14T08:32:47.385649Z"}, {"uuid": "e28fded0-9a44-4483-8b5c-965c2ecb2d37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117268493232558963", "content": "CVE-2026-85706 GitLab CE/EE: unauthenticated arbitrary file read via commits API, CVSS 10. Affects 18.7 up to 19.1.8, 19.2.6, 19.3.2. No patch confirmed yet, restrict access now. https://www.valtersit.com/cve/CVE-2026-85706/ #CVE #GitLab #infosec", "creation_timestamp": "2026-09-14T08:40:07.577629Z"}, {"uuid": "b53c2ade-367e-4444-a6b1-1378fcd12a3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mvhq4kghgd2f", "content": "CVE-2026-85706 GitLab CE/EE: unauthenticated arbitrary file read via commits API, CVSS 10. Affects 18.7 up to 19.1.8, 19.2.6, 19.3.2. No patch confirmed yet, restrict access now. https://www.valtersit.com/cve/CVE-2026-85706/ #CVE #GitLab #infosec", "creation_timestamp": "2026-09-14T08:50:04.180742Z"}, {"uuid": "fa7565e9-012b-413a-acc5-394ddb56b88d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/xakep_ru/20046", "content": "\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0438 \u0441\u0440\u043e\u0447\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab\n\n\u0418\u043d\u0436\u0435\u043d\u0435\u0440\u044b GitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-85706, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\nhttps://xakep.ru/2026/09/14/gitlab-patch/", "creation_timestamp": "2026-09-14T09:00:04.410301Z"}, {"uuid": "c45c08f4-9626-47c4-b8ea-080299415a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102269", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gabrielunknown\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Perl\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-14 05:14:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706 \u2014 GitLab Unauthenticated Arbitrary File Read exploit PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-14T09:00:04.463001Z"}, {"uuid": "1877a855-55be-478d-9a18-e223979687f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvhqteuujo24", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T09:02:48.364226Z"}, {"uuid": "996b370c-f6dc-4010-9310-19d8c11dbfac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvhseaq7wt2u", "content": "\ud83d\udce2 [VULN] GitLab : mise \u00e0 jour de s\u00e9curit\u00e9 critique CVE-2026-85706\n\nGitLab a publi\u00e9 le 10 septembre des mises \u00e0 jour de s\u00e9curit\u00e9. Ce patch critique concerne les versions enterprise et communautaire.\n\n#CVE #Cyberveille", "creation_timestamp": "2026-09-14T09:30:08.174668Z"}, {"uuid": "aa710f9f-6d25-46d1-996d-5fa710207cec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "content": "", "creation_timestamp": "2026-09-14T10:00:04.534772Z"}, {"uuid": "1a22e261-98fd-40ca-88e4-e52bbf7e7956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mviwrre4ds2q", "content": "Monday's fuck up - This Time - Gitlab - CVE-2026-85706   GitLab CE/EE\n\nVersion:  18.7\u201319.1.7, 19.2.0\u201319.2.5, 19.3.0\u201319.3.1\n\nexploit - github.com/guneykabel/c... #redteam #gitlab #ce-ee #exploit #cve-2026-85706 #critical", "creation_timestamp": "2026-09-14T10:22:16.721659Z"}, {"uuid": "e4f37f71-c510-48d2-91ba-e983655b0310", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mvhvnwpatb2l", "content": "GitLab CVE-2026-85706, a path traversal flaw, fully exploited within 24 hours of disclosure. #GitLab #CVE2026-85706 #PathTraversal #Exploited https://securityaffairs.com/198945/hacking/gitlab-cve-2026-85706-one-http-request-no-authentication-full-file-read-exploited-within-24-hours.html", "creation_timestamp": "2026-09-14T10:29:14.740486Z"}, {"uuid": "cf3a2bb8-d110-459c-9a52-c078277c92e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvhy25krcz2i", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.2% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T11:11:52.116593Z"}, {"uuid": "fb7de622-52b3-4872-8f8e-4719abc8ae9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvhy26a7zt2n", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 EPSS 1.2% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #potatosecurity #threatintel", "creation_timestamp": "2026-09-14T11:11:52.752098Z"}, {"uuid": "6a47b897-d643-4d8c-b2f5-105ea6bfb422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mvi2d4e7ic2x", "content": "GitLab CVE-2026-85706: One HTTP Request, No Authentication, Full File Read \u2013\nExploited Within 24 Hours\nsecurityaffairs.com/198945/hacki...", "creation_timestamp": "2026-09-14T11:52:41.871823Z"}, {"uuid": "9183c1b9-145e-4f96-bc2b-fe861adbadfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/jP5i0elPtle8Ek1urEeGQwWyb2IHykjb4RwkAMHe7Tv9BPk", "content": "", "creation_timestamp": "2026-09-14T12:00:04.276418Z"}, {"uuid": "77e2d530-dc8f-4a0d-860b-844739e13018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://gist.github.com/ichintu/6e4365e719efc73cff29fb6a2ec0065b", "content": "**September 14, 2026 Cyber Threat Intelligence Digest**\n\nThis briefing highlights critical vulnerabilities, AI-driven security shifts, and industry insights:\n\n\u2022 **Active Threats & Vulnerabilities:** A CVSS 9.9 OS command injection flaw (CVE-2026-90699) affects the D-Link DWR-M920 with public exploits. NCSC/CISA warn of active exploitation of a critical GitLab path traversal (CVE-2026-85706). ~2.6 million MikroTik routers expose public services, and an authenticated TYPO3 extension flaw (CVE-2023-50461, CVSS 8.8) enables arbitrary code execution. Separately, a malicious Twitch browser extension leaked OAuth tokens for ~31,000 users to a Russian bot service.\n\n\u2022 **AI & Patching Dynamics:** Microsoft\u2019s September update addresses ~972 vulnerabilities, largely uncovered by AI scanning. While AI accelerates detection, it also compresses patch windows as exploits are rapidly reverse-engineered from new releases.\n\n\u2022 **AI Governance & Leadership:** The 3M ChatGPT litigation case underscores that AI interaction logs are discoverable evidence, requiring risk-based retention, cross-functional accountability, and proactive legal compliance. On career development, transitioning from technical security roles to leadership (e.g., CISO) demands a shift toward business strategy, cross-functional communication, and continuous learning beyond pure cybersecurity.", "creation_timestamp": "2026-09-14T12:02:18.817167Z"}, {"uuid": "a43631c8-3bfa-4d9d-9745-6a54cd6953c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvi3imneac2c", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 1\u2026\nCVSS 10 \u00b7 EPSS 1.2% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T12:13:38.561419Z"}, {"uuid": "358eb94e-8044-4ab1-9100-71ef2c7b9af9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117269404622243316", "content": "CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild#CVE_2026_85706 https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/", "creation_timestamp": "2026-09-14T12:31:50.170038Z"}, {"uuid": "f21b5681-6c90-4508-9061-ee6f773ae2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvi4ld63v42i", "content": "~Checkpoint~\nBreaches, AI abuse, ransomware surge, and critical actively exploited flaws demand urgent patching.\n-\nIOCs: CVE-2026-85706, CVE-2026-81963, CVE-2026-85046\n-\n#Ransomware #ThreatIntel #Vulnerabilities", "creation_timestamp": "2026-09-14T12:33:03.767393Z"}, {"uuid": "c76977fd-b524-4a16-852e-6448b7c54265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvi5am5utv2b", "content": "\ud83d\udcf0 CISA Peringatkan Celah GitLab Kritis CVE-2026-85706 Kini Dieksploitasi Hacker\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/14/cisa-cve-2026-85706-gitlab-dieksploitasi/\n\n#cybersecurity #dataBreach #devsecops #gitlab #keamanan #keamananSiber #teknologi #vulnerability", "creation_timestamp": "2026-09-14T12:44:57.126217Z"}, {"uuid": "c632900c-3049-497a-9311-3776235810bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3mvibhxduuf2e", "content": "GitLab sotto attacco: falla CVSS 10 legge file senza autenticazione\nCISA conferma lo sfruttamento di CVE-2026-85706, falla GitLab CVSS 10 che permette di leggere f...\nhttps://www.ilsoftware.it/gitlab-sotto-attacco-falla-cvss-10-legge-file-senza-login/", "creation_timestamp": "2026-09-14T14:00:38.608963Z"}, {"uuid": "8d70c0a8-ea7e-4368-b89f-0f73b18ff101", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvicpdfnuf24", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 1\u2026\nCVSS 10 \u00b7 EPSS 1.2% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T14:22:39.919585Z"}, {"uuid": "93011768-fe1b-4d92-903b-1b744c83cb72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/forsmile.jp/post/3mvidnrkit22p", "content": "\u3010\u7dca\u6025\u3011GitLab \u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\uff08CVE-2026-85706 / CVSS 10.0 CRITICAL\uff09\n\n\u81ea\u793e\u904b\u7528\uff08self-managed\uff09\u306eGitLab\u3067\u3001\u672a\u8a8d\u8a3c\u306e\u653b\u6483\u8005\u304c\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u4efb\u610f\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u53d6\u308c\u307e\u3059\u3002CISA\u306f2026\u5e749\u670811\u65e5\u306bKEV\uff08\u60aa\u7528\u78ba\u8a8d\u6e08\u307f\uff09\u3078\u767b\u9332\u3057\u307e\u3057\u305f\u3002\n\n\u5bfe\u51e6: 19.1.8\uff0f19.2.6\uff0f19.3.2\u306e\u3044\u305a\u308c\u304b\u3078\u5373\u66f4\u65b0\u3002GitLab.com\u3068Dedicated\u306f\u5bfe\u5fdc\u4e0d\u8981\u3067\u3059\u3002\n\nforsmile.jp/articles/git...", "creation_timestamp": "2026-09-14T14:39:42.609898Z"}, {"uuid": "082f141f-afbc-440e-8f4d-2a54005a3c52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117269915963835883", "content": "\u26a0\ufe0fGitLab : CVE-2026-85706 est activement exploit\u00e9e. \nUne faille critique de travers\u00e9e de r\u00e9pertoires permet \u00e0 un attaquant non authentifi\u00e9 de lire des fichiers arbitraires sur le serveur.\nEncore une vuln\u00e9rabilit\u00e9 qui prend des chemins de traverse\u2026../../../../etc/ :dumpster_fire_gif:  \ud83d\udc40\n-->GitLab auto-h\u00e9berg\u00e9 expos\u00e9 sur Internet : mise \u00e0 jour rapide recommand\u00e9e.\nCorrectifs : 19.1.8, 19.2.6 et 19.3.2.\nLa faille a d\u00e9j\u00e0 rejoint le catalogue KEV de la CISA, et \u00e7a commence clairement \u00e0 renifler autour : watchTowr et plusieurs honeypots ont d\u00e9j\u00e0 vu passer des tentatives de probing.\nOnyphe recense une bonne centaine d\u2019instances vuln\u00e9rables en CH aujourd'hui...\n#CyberVeille #GitLab #CVE202685706", "creation_timestamp": "2026-09-14T14:41:55.060916Z"}, {"uuid": "d3b69b7f-63df-41ab-9b3c-54ec3f193633", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vtsecurity.bsky.social/post/3mvieyucob22d", "content": "si ten\u00e9s gitlab self hosted y no actualizaste desde el 10/9, hacelo hoy. cve-2026-85706, cvss 10: path traversal sin login que deja leer archivos del server, y lo empezaron a explotar al d\u00eda siguiente del parche", "creation_timestamp": "2026-09-14T15:03:56.682817Z"}, {"uuid": "a5b99a0e-0b2e-4300-832e-db243cef98d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mviguv3g422g", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 1\u2026\nCVSS 10 \u00b7 EPSS 1.2% \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T15:37:21.176423Z"}, {"uuid": "07b0cbda-9d4e-4906-9b66-bb161f2e9303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/nUtgLh6502OLuiOIs3tpfONHzlPir0_S3whIg0M9zp0dVVU", "content": "", "creation_timestamp": "2026-09-14T16:00:05.889140Z"}, {"uuid": "907a861d-3e66-4e66-aba6-6d42ad734e94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mvilsxbnek2j", "content": "Overview On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706 , a criti...\n\n\ud83d\udd17 https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild", "creation_timestamp": "2026-09-14T17:05:47.319096Z"}, {"uuid": "f8a4b3e6-7912-41d1-b016-020be2d06034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/jameshoward.us/post/3mvinrzl3ha2d", "content": "GitLab patched CVE-2026-85706, a CVSS 10 arbitrary-file-read flaw now listed by CISA as actively exploited. Patching closes the read path. It cannot revoke a secret already copied. On a source-code and CI/CD platform, remediation has to restore trust, not just software versions.", "creation_timestamp": "2026-09-14T17:41:10.370018Z"}, {"uuid": "8b5d5a94-1e4c-450f-8ac5-85f0136ccb1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117270646924865644", "content": "New.\nRapid7: CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/ @Rapid7Official #infosec #GitLab #vulnerability", "creation_timestamp": "2026-09-14T17:47:45.294713Z"}, {"uuid": "0d0b9557-9bbf-4a69-9e6d-a55ff2dee49c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/technobezz.com/post/3mvipfjehxl2m", "content": "GitLab has released fixes for CVE-2026-85706, a maximum-severity path traversal flaw in the repository commits API that CISA says is being actively exploited.", "creation_timestamp": "2026-09-14T18:09:50.296909Z"}, {"uuid": "a31de219-a350-4a79-b5a2-e7bf5e773a98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/technobezz.com/post/3mvipfjh3362g", "content": "GitLab has released fixes for CVE-2026-85706, a maximum-severity path traversal flaw in the repository commits API that CISA says is being actively exploited.", "creation_timestamp": "2026-09-14T18:09:50.767063Z"}, {"uuid": "f787fd33-7300-4012-8d71-e633991ed9ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/BleepingComputer/25542", "content": "\u200aGitLab urges users to patch max severity path traversal flaw\n\nGitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]\n\nhttps://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "creation_timestamp": "2026-09-14T20:00:04.983489Z"}, {"uuid": "e2401ed2-0fbd-457b-9600-cf4f9a7d6e6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mvivngbv6u23", "content": "CRITICAL CISA KEV ALERT: CVE-2026-85706 targets GitLab CE/EE via path traversal in the repository commits API. Active exploitation verified. Access our TSUITE brief for SIEM detection queries and compensating controls to protect your CI/CD pipeline and isolate your\u2026", "creation_timestamp": "2026-09-14T20:01:37.727039Z"}, {"uuid": "adf45b58-1139-43a0-8c24-0bc921b6258d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvivomxx7m2v", "content": "Self-hosted GitLab CVE-2026-85706 (CVSS 10.0) allows unauthenticated arbitrary file reads and is being exploited in the wild \u2014 apply the vendor patch released 2026-09-10 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-14T20:02:17.815188Z"}, {"uuid": "cf9b47ec-c60b-4423-871a-7d6279280d15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvj3pofyzr2q", "content": "\ud83e\udd16 CVE-2026-85706 (CVSS 10.0): unauthenticated arbitrary file read in GitLab CE/EE via the repository commits API. Affects 18.7\u201319.3; fixed in 19.1.8, 19.2.6, 19.3.2. Actively exploited, in CISA KEV. Patch now.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85706", "creation_timestamp": "2026-09-14T21:50:14.878336Z"}, {"uuid": "ef10ccad-8508-4b67-b8be-40765e62058d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/true_secator/8607", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0432 GitLab \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 GitLab.\n\nWatchTowr \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f.\n\nCVE-2026-85706 (CVSS 10/10) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Community Edition (CE) \u0438 Enterprise Edition (EE) \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 18.7 (\u0434\u043e 19.1.8), 19.2 (\u0434\u043e 19.2.6) \u0438 19.3 (\u0434\u043e 19.3.2).\n\n\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a GitLab \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043f\u0430\u0442\u0447\u0435\u0439 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, WatchTowr \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u044d\u0442\u043e \u0443\u0436\u0435 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u043b\u0443\u0447\u0430\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 GitLab \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438, \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 GraphQL (CVE-2026-19478), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c WatchTowr, \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 HTTP POST-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a URI /api/v4/projects/{id}/repository/commits/, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b file.path, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u0421\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b GitLab \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u043e\u0432\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u0435\u0449\u0435 17 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2026-87719 (CVSS 9,9/10) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u043e\u043a GraphQL, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u00ab\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c\u00bb.\n\n\u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab CE/EE 19.1.8, 19.2.6 \u0438 19.3.2 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434, \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c CI/CD, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c XSS-\u0430\u0442\u0430\u043a\u0438 \u0438 DoS.\n\n\u041f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c GitLab \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u0430, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c\u0443 \u043a\u043e\u0434\u0443, \u0441\u0435\u043a\u0440\u0435\u0442\u0430\u043c CI/CD, \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u044b \u0441\u0431\u043e\u0440\u043a\u0438, \u043f\u043e\u043b\u0443\u0447\u0430\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c\u0443 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0443 \u0438\u043b\u0438 \u043e\u0442\u0440\u0430\u0432\u043b\u044f\u044f \u0435\u0433\u043e, \u0447\u0442\u043e, \u043a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430, \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0430\u0442\u0430\u043a\u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u0430\u043e\u043b\u044c\u044f.", "creation_timestamp": "2026-09-14T23:00:03.239669Z"}, {"uuid": "f28c18c2-bcca-4136-8d5d-a504f76f5bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/x38-sxvf4qgSSEOQO0rIsdAof5ij13oL7xnEFNSRLy91YY4", "content": "", "creation_timestamp": "2026-09-14T23:00:03.663370Z"}, {"uuid": "0f458488-7f8a-44b9-aac4-f8ea7eb7dae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/c0VCdpqgv4zIIacHg-iVEnpS56wswa4WFwv-IovR6vad_Wk", "content": "", "creation_timestamp": "2026-09-15T00:00:21.341657Z"}, {"uuid": "b93b7f0c-e411-46af-a6f0-3a9b02e4d031", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/0phjcISM7xaEvPyzzbSiHps9Ynh5NA4Z3_XacHD49buP-a4", "content": "", "creation_timestamp": "2026-09-15T00:00:21.541192Z"}, {"uuid": "f8f520cc-6fe2-4019-ae07-59a34a3be8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/true_secator/8607", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0432 GitLab \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 GitLab.\n\nWatchTowr \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab \u0441\u043f\u0443\u0441\u0442\u044f \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f.\n\nCVE-2026-85706 (CVSS 10/10) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Community Edition (CE) \u0438 Enterprise Edition (EE) \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 18.7 (\u0434\u043e 19.1.8), 19.2 (\u0434\u043e 19.2.6) \u0438 19.3 (\u0434\u043e 19.3.2).\n\n\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443, \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0434\u0435\u043d\u044c \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a GitLab \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043f\u0430\u0442\u0447\u0435\u0439 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, WatchTowr \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445.\n\n\u041f\u0440\u0438\u0447\u0435\u043c \u044d\u0442\u043e \u0443\u0436\u0435 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u043b\u0443\u0447\u0430\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 GitLab \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043d\u0435\u0434\u0435\u043b\u0438, \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 GraphQL (CVE-2026-19478), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0441\u0440\u0430\u0437\u0443 \u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c WatchTowr, \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043c\u0430\u0441\u0441\u043e\u0432\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 HTTP POST-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043a URI /api/v4/projects/{id}/repository/commits/, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b file.path, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u044f\u0432\u0438\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\u0421\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b GitLab \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u043e\u0432\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0442 \u0435\u0449\u0435 17 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0435\u0449\u0435 \u043e\u0434\u043d\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443.\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2026-87719 (CVSS 9,9/10) \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0432 \u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440\u0435 \u043f\u043e\u0434\u043f\u0438\u0441\u043e\u043a GraphQL, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u00ab\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u043c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c\u00bb.\n\n\u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 GitLab CE/EE 19.1.8, 19.2.6 \u0438 19.3.2 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434, \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c CI/CD, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c XSS-\u0430\u0442\u0430\u043a\u0438 \u0438 DoS.\n\n\u041f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c GitLab \u0434\u043b\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u0430, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c\u0443 \u043a\u043e\u0434\u0443, \u0441\u0435\u043a\u0440\u0435\u0442\u0430\u043c CI/CD, \u0443\u0447\u0435\u0442\u043d\u044b\u043c \u0434\u0430\u043d\u043d\u044b\u043c \u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0432\u0435\u0439\u0435\u0440\u044b \u0441\u0431\u043e\u0440\u043a\u0438, \u043f\u043e\u043b\u0443\u0447\u0430\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u044e\u0431\u043e\u043c\u0443 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c\u0443 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0443 \u0438\u043b\u0438 \u043e\u0442\u0440\u0430\u0432\u043b\u044f\u044f \u0435\u0433\u043e, \u0447\u0442\u043e, \u043a\u0430\u043a \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430, \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c \u0430\u0442\u0430\u043a\u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u0430\u043e\u043b\u044c\u044f.", "creation_timestamp": "2026-09-15T00:00:08.667196Z"}, {"uuid": "64775519-f27b-4417-80ef-89433160c736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/nUtgLh6502OLuiOIs3tpfONHzlPir0_S3whIg0M9zp0dVVU", "content": "", "creation_timestamp": "2026-09-15T00:00:20.018166Z"}, {"uuid": "7b5b4992-2e23-4361-85e1-9ddbbb7de026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/jP5i0elPtle8Ek1urEeGQwWyb2IHykjb4RwkAMHe7Tv9BPk", "content": "", "creation_timestamp": "2026-09-15T00:00:21.693107Z"}, {"uuid": "c458153a-d51e-4c00-bace-3c8f548ff2bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/-crZ7c2mXyDAnAi6cUoO6ZGLIobDD_pIiFk-5o6QD17WEzY", "content": "", "creation_timestamp": "2026-09-15T00:00:25.312415Z"}, {"uuid": "46505c83-307b-4e56-9de2-5527d6f33fdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/cfwIjD0BfTttpxj-RZnmg61xri6aKpaW-Ttu0tih2neg1Gg", "content": "", "creation_timestamp": "2026-09-15T00:00:22.187054Z"}, {"uuid": "f6f422d6-bbff-46b5-b165-2239966dd357", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/cETmR6PmVA-Oz0aW9cR5toB5HzP84uGj8tzgORzgcaHdb5Y", "content": "", "creation_timestamp": "2026-09-15T00:00:24.067697Z"}, {"uuid": "6b5b9c5c-8a9e-4a9d-b1b9-2338851ade13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/SISeOiJWiDHPKa0-EGjfIE-t_IZnqvMDmbIqcTRDP3O63UA", "content": "", "creation_timestamp": "2026-09-15T00:00:22.447158Z"}, {"uuid": "d1731c00-85f9-476e-b886-799c65678f8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/kfD60J2UFpQrUT2d1fHwZFZR0EOgcWXJFI_DVICUAmaNmlo", "content": "", "creation_timestamp": "2026-09-15T00:00:26.545517Z"}, {"uuid": "b33e0a9b-3c08-44ea-898a-426a589c8c38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/dfvCKy19LdeRjtEqhcraGN2yMY0QlrZmHiFOXJRBkeySQpk", "content": "", "creation_timestamp": "2026-09-15T00:00:23.626692Z"}, {"uuid": "f3737eee-0dc9-440f-bd81-a20b5685c72c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/NaqXpJzudf_kPemcfRLNgSuhJAIsHS0qYFopzKAZDt10jI8", "content": "", "creation_timestamp": "2026-09-15T00:00:23.925653Z"}, {"uuid": "e957f253-708b-49b6-80f6-55ea602f161e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/CIwg3dUruFUkA2IiAP63EE_3LOdvwiOYKhxCOUQk67UuENI", "content": "", "creation_timestamp": "2026-09-15T00:00:29.518412Z"}, {"uuid": "e712746d-db2e-47d2-8c02-8318144539b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "Telegram/Or8cOVwjk2WFAzgSTrZIaBGdmd4E-wdL1OqEpv7q9KHYvg", "content": "", "creation_timestamp": "2026-09-15T00:00:31.468321Z"}, {"uuid": "0b92d437-e319-4426-9db6-2e9c3c73cc30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/iBj7RYtihqm6hIuCBk6vB4PmaU6fP95etshgJ7uPz9bghck", "content": "", "creation_timestamp": "2026-09-15T00:00:24.716859Z"}, {"uuid": "dba55463-d98f-471c-81fe-269f0e95f795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102269", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a gabrielunknown\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Perl\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-14 05:14:39\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706 \u2014 GitLab Unauthenticated Arbitrary File Read exploit PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-15T00:00:24.793411Z"}, {"uuid": "bf75d828-50d8-4e3d-b69f-ce036328bfe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/xakep_ru/20046", "content": "\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0438 \u0441\u0440\u043e\u0447\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GitLab\n\n\u0418\u043d\u0436\u0435\u043d\u0435\u0440\u044b GitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-85706, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e \u0432\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043d\u0430\u0447\u0430\u043b\u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\nhttps://xakep.ru/2026/09/14/gitlab-patch/", "creation_timestamp": "2026-09-15T00:00:24.843388Z"}, {"uuid": "431d4fd5-9efe-4c10-a2f3-0dd2ed308cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/ikehjames25.bsky.social/post/3mvjggwyba52s", "content": "GitLab Patches Maximum Severity Vulnerability in CI/CD\u00a0Infrastructure\n\nGitLab has addressed a critical path traversal vulnerability, CVE-2026-85706, which enables unauthenticated attackers to access arbitrary files and secrets.", "creation_timestamp": "2026-09-15T01:02:14.101079Z"}, {"uuid": "c51952a8-e943-4a02-88f1-b1dde5549da8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.darkreading.com/cyberattacks-data-breaches/maximum-severity-gitlab-flaw-supply-chains-risk", "content": "CVE-2026-85706 is a path traversal vulnerability with a 10 out of 10 CVSS score, affecting both GitLab Community Edition and Enterprise Edition instances.", "creation_timestamp": "2026-09-15T01:00:34.127705Z"}, {"uuid": "a53968dc-2f97-46e8-afe9-867ad0df3528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvjhnb2znr2y", "content": "CVE-2026-85706 enables unauthenticated arbitrary file reads via path traversal in GitLab repository commits API, affecting self-managed CE/EE and already being probed.\n", "creation_timestamp": "2026-09-15T01:23:40.061937Z"}, {"uuid": "4cf6e4a3-d476-4032-b5a8-99234b76dc8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvjhnhyoka22", "content": "CVE-2026-85706 enables unauthenticated arbitrary file reads via path traversal in GitLab repository commits API, affecting self-managed CE/EE and already being probed.\n", "creation_timestamp": "2026-09-15T01:23:46.383498Z"}, {"uuid": "156e68cb-0116-4063-8df6-cea98b1d8ec1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvjhnjai2z2g", "content": "CVE-2026-85706 enables unauthenticated arbitrary file reads via path traversal in GitLab repository commits API, affecting self-managed CE/EE and already being probed.\n", "creation_timestamp": "2026-09-15T01:23:47.997690Z"}, {"uuid": "6739f5a7-1fd7-4bfb-9f48-3083c35aeccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvjk2ykj762j", "content": "\ud83d\udccc CVE-2026-85706 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under ... https://www.cyberhub.blog/cves/CVE-2026-85706", "creation_timestamp": "2026-09-15T02:07:07.216597Z"}, {"uuid": "af199268-0ade-4b53-bee8-32afbf67ff7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hackmag.com/post/3mvjnfxzduv2g", "content": "\ud83d\udfe2 Developers Urge Immediate Fix for Critical GitLab Vulnerability\n\n\ud83d\udde8\ufe0f GitLab engineers have released patches for the critical CVE-2026-85706 vulnerability, which received the maximum CVSS sc\u2026\n\n#news", "creation_timestamp": "2026-09-15T03:06:57.476563Z"}, {"uuid": "8b65e5bc-2013-4de9-a5d6-6d29fa45a0a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvjnx4vpi624", "content": "If you run GitLab, CVE-2026-85706 (CVSS 10.0) unauthenticated path traversal is being exploited in the wild \u2014 apply the vendor patch now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-15T03:16:32.941445Z"}, {"uuid": "d2eaad64-3614-4ca0-b4f6-b2aabf030875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cryptovkanews.bsky.social/post/3mvjo4xw3uo2s", "content": "\ud83d\udea8 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-85706 \u0432 GitLab! \ud83d\udea8 \u041d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432. \u0420\u0438\u0441\u043a: \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u0438\u043a\u043e\u0432 \u0441\u043c\u0430\u0440\u0442-\u043a\u043e\u043d\u0442\u0440\u0430\u043a\u0442\u043e\u0432, API-\u0442\u043e\u043a\u0435\u043d\u043e\u0432. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 GitLab \u0434\u043e 19.1.8, 19.2.6 \u0438\u043b\u0438 19.3.2! #GitLab #\u043a\u0440\u0438\u043f\u0442\u043e #\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c", "creation_timestamp": "2026-09-15T03:19:49.402219Z"}, {"uuid": "c66de9d0-0364-491f-93d8-5c7c46406eda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/goodtech.info/post/3mvjoy32ucoec", "content": "Score parfait de 10.0 et exploitation en 24 heures : comment la faille de GitLab met \u00e0 nu les serveurs\n\n\ud83d\udca5 Un score parfait de 10.0 sur l'\u00e9chelle CVSS et des attaques d\u00e9tect\u00e9es en moins de 24 heures ! Le CERT-FR et la CISA...\n\nhttps://goodtech.info/gitlab-faille-critique-cve-2026-85706-cisa-cert-fr/", "creation_timestamp": "2026-09-15T03:35:06.431285Z"}, {"uuid": "f2c799c2-51b7-4ee3-950e-b31412c12cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvjqhw35zg2l", "content": "\ud83d\udea8 BREAKING: CISA confirms active exploitation of GitLab CVE-2026-85706 (path traversal, unauth file read) \u2014 add to KEV catalog, 3-day federal patch deadline. Sandworm chains Cisco CVE-2026-20079 auth bypass \u2192 Cyclops Blink. DDRop hardware attack breaks Intel TDX / AMD SEV-SNP confidential computi...", "creation_timestamp": "2026-09-15T04:01:43.058426Z"}, {"uuid": "b39d0ad8-ce30-4b60-bc60-4627024237c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mvjqicbqfj24", "content": "1/ GITLAB: CVE-2026-85706 \u2014 missing auth enforcement in repo commits API; unauth attackers read secrets/files in one HTTP POST. WatchTowr sees in-the-wild probes; CISA BOD 26-04 requires federal fix by Sept 14. Patch to 19.3.2/19.2.6/19.1. Src: BleepingComputer, DarkReading", "creation_timestamp": "2026-09-15T04:01:56.058220Z"}, {"uuid": "49ec5cd7-0d95-410c-81cf-ef8fdff2dd9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621", "content": "This daily threat intelligence digest highlights three high-impact vulnerabilities:\n\n\u2022 **CVE-2026-91771 (Weights & Biases, 8.8):** Path traversal in `File.download` (wandb < 0.29.0) allows attackers to write files outside intended directories, potentially enabling remote code execution.\n\u2022 **CVE-2026-90843 (SabyasachiRana WebMap, 8.3):** Remote OS command injection in the `nmap_newscan` function. Publicly exploited; a silent patch is available.\n\u2022 **CVE-2026-85706 (GitLab, 10.0):** Critical unauthenticated path traversal in the repository commits API affects GitLab CE/EE (versions prior to 19.1.8, 19.2.6, and 19.3.2). Enables arbitrary file reads, risking credential theft and CI/CD compromise. Actively exploited, CISA KEV-listed, and patched.\n\n**Recommended Actions:** Prioritize immediate GitLab patching. Hunt logs for malicious API requests, rotate any potentially exposed credentials, and enforce strict access controls and API monitoring across all affected platforms.", "creation_timestamp": "2026-09-15T04:02:20.162115Z"}, {"uuid": "08f698df-2f0c-468e-92fc-8f7e1526d7b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvjtv6xzqn2z", "content": "Daily IT Security Digest \u2014 2026-09-15\nhttps://infosec.exchange/@offseq/117251586510013041\n\n## 2. GitLab Path Traversal Exploited in the Wild (CRITICAL \u2014 CVSS 10)\n\nRapid7 has reported that CVE-2026-85706, a critical path traversal vulnerability in GitLab, is being actively exploited to steal files", "creation_timestamp": "2026-09-15T05:02:50.255148Z"}, {"uuid": "89cdf0c6-7827-4a16-88cf-0bfc2eddd49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvjz7klh3o2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-20079: 22 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-85706: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-51990: 5 interactions\nCVE-2026-76461: 5 interactions\nCVE-2026-85706: 5 interactions\n", "creation_timestamp": "2026-09-15T06:38:06.907703Z"}, {"uuid": "6241564d-436c-4403-be61-8a8c426bcc95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/merrua.bsky.social/post/3mvkcw2gzwk25", "content": "www.theregister.com/security/202... \"CVE-2026-85706 to its Known Exploited Vulnerabilities catalog.\"", "creation_timestamp": "2026-09-15T09:31:48.205634Z"}, {"uuid": "116bc455-59f2-4cb7-8984-a89a1ba42b8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/qubblelabs.com/post/3mvkpbw5oe22n", "content": "GitLab CVE-2026-85706 (10.0 CVSS) exposes CI runners' signing keys via path traversal. Compromised control plane enables artifact forgery\u2014echoing XZ Utils. Source: Dark Reading.", "creation_timestamp": "2026-09-15T13:13:08.878881Z"}, {"uuid": "5dac60fe-aeef-4bf9-a4c7-aa1911b88435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/five-oclick-tech.bsky.social/post/3mvl57lzztp2n", "content": "GitLab 10.0 bug under active attack \ud83d\udea8\n\nCISA confirms active exploitation of a critical GitLab vulnerability (CVE-2026-85706) allowing unauthenticated attackers to read arbitrary files from self-managed servers.\n\nA perfect 10 CVSS score means patching isn't optional for internet-facing instances.", "creation_timestamp": "2026-09-15T17:22:23.242226Z"}, {"uuid": "f8c4e566-6a6c-41fc-9b3b-eee0c36f1165", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/bhinfosecurity.bsky.social/post/3mvl6a4xflz23", "content": "Hunting CVE-2026-85706 in GitLab logs? \nA 400 saying \"branch is required\" is not a failed attempt. It means the file was read.\n \nWe proved it by planting files with known contents and watching the error change.\n\nhttps://activesoc.blackhillsinfosec.com/blog/the-gitlab-exploit-with-no-traversal-in-it/", "creation_timestamp": "2026-09-15T17:40:34.356937Z"}, {"uuid": "3d0c7811-5c18-40b6-a832-18330afbf304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mvl6gct6ud24", "content": "GitLab has patched CVE-2026-85706, a CVSSv3.1 10.0 path traversal vulnerability in the repository commits API that allows an unauthenticated user to read arbitrary files from GitLab CE and EE servers. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September ..", "creation_timestamp": "2026-09-15T17:44:01.855320Z"}, {"uuid": "00954bd5-d4b7-4994-9a51-aeabd0591d6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mvlft6o2os2y", "content": "*burp* CISA just KEV'd GitLab's max-severity path traversal\u2014CVE-2026-85706. No login. One HTTP hit. Credentials and secrets fall out of the commits API. watchTowr already sees the probes. Congrats Earth: your CI vault answers to anyone who asks politely with dots. day259.011", "creation_timestamp": "2026-09-15T19:56:33.073610Z"}, {"uuid": "613a9c80-af7c-4d8f-bdfd-8e7f44227019", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvln4rfgs22e", "content": "\ud83d\udccc GitLab CVE-2026-85706: Critical Path Traversal Vulnerability Exploited Within 24 Hours https://www.cyberhub.blog/article/32094-gitlab-cve-2026-85706-critical-path-traversal-vulnerability-exploited-within-24-hours", "creation_timestamp": "2026-09-15T22:07:08.661445Z"}, {"uuid": "18620845-a9fb-4b42-b710-f945adbe87d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/eric.zip/post/3mvm2oubapk2t", "content": "Dropped some research and detection/hunt content on CVE-2026-85706 \ud83e\udd13", "creation_timestamp": "2026-09-16T02:09:53.267925Z"}, {"uuid": "58169e88-eb8e-4713-9385-f2e74445ddd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/insomnisec.bsky.social/post/3mvm6ez2hp62g", "content": "\ud83d\udce1 GitLab Path Traversal (CVE-2026-85706): A Perfect 10 Under Active Attack", "creation_timestamp": "2026-09-16T03:15:57.445232Z"}, {"uuid": "179be552-2231-4135-8c19-9fa950be4719", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/CyberDispatch/2908", "content": "GitLab\u2019s CVSS 10 file-read flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure.\n\nIf an instance has at least one public project, unauthenticated attackers can read logs and config files containing credentials and secrets.", "creation_timestamp": "2026-09-16T04:00:05.412948Z"}, {"uuid": "d0d57ffb-89ef-4b98-bc11-6704f50a6416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mvmbsioweg26", "content": "Learn why CISA added GitLab CVE-2026-85706 to the Known Exploited Vulnerabilities catalog. Discover how this CVSS 10 flaw allows remote secret extraction.\n\n#GitLab #CVE202685706 #CISA #CyberSecurity #Vulnerability", "creation_timestamp": "2026-09-16T04:17:11.727922Z"}, {"uuid": "9507bba0-afc7-4b16-a450-1850dfc46bb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mvmgc2rpwy2h", "content": "Actionable C-Suite threat intelligence for CVE-2026-85706, covering active path traversal exploitation vectors, endpoint hardening, and patch automation across GitLab environments. https://thecybermind.co/uzke", "creation_timestamp": "2026-09-16T05:37:29.455771Z"}, {"uuid": "fd83918b-e7b3-40ae-a193-d7880076caee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvmjrhg5az2k", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 40 interactions\nCVE-2026-20079: 24 interactions\nCVE-2026-85880: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85706: 19 interactions\nCVE-2026-58231: 4 interactions\nCVE-2026-76461: 3 interactions\n", "creation_timestamp": "2026-09-16T06:39:46.333400Z"}, {"uuid": "cafb1075-c6d6-4ab7-867d-119a187cdfe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mvmoum4aw52h", "content": "COGNOSCERE Tech Brief \u2014 2026-09-16\n\nCVE-2026-85706 is a path traversal bug in GitLab's repository commits API that l\n\nhttps://youtube.com/watch?v=IX-tj2FALFU\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-09-16T08:11:02.061028Z"}, {"uuid": "c09f056e-8786-42c4-8ec0-1dc8603a1513", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/steelwise.bsky.social/post/3mvmouqgsgn2g", "content": "If you self-host GitLab, patch it today: this one is CVSS 10. CVE-2026-85706 lets an attacker read arbitrary files from a self-hosted GitLab server without logging in. It's rated CVSS 10, the maximum possible severity, and it's already being\u2026 Read the filing #gitlab #patchnow #devsecops #infosec", "creation_timestamp": "2026-09-16T08:11:05.330190Z"}, {"uuid": "1f47b168-9935-4462-9440-9f870548bf2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mvmwcrlztq2p", "content": "Original text: \"CVE-2026-85706: GitLab CE/EE unauthenticated path traversal in Repository Commits API\" \u2014 Pruva, reproduction REPRO-2026-00354 (12 September 2026). Advisory: GitLab 19.3.2. Ruby snippets and HTTP eviden\nhttps://core-jmp.org/2026/09/cve-2026-85706-gitlab-workhorse-json-file-read-pruva/", "creation_timestamp": "2026-09-16T10:24:13.313137Z"}, {"uuid": "e639e2ff-2df9-45d3-8ed5-6a2b023939b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/secmedia/4005", "content": "\u2328\ufe0f GitLab \u0437\u0430\u043a\u0440\u044b\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 10 \u0438\u0437 10 \u043f\u043e CVSS\n\nCVE-2026-85706 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043e\u0434\u043d\u0438\u043c POST-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430. GitLab \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f, \u0430 CISA \u0443\u0436\u0435 \u0432\u043d\u0435\u0441\u043b\u043e \u0431\u0440\u0435\u0448\u044c \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n\ud83d\ude0e  \u0417\u0434\u0435\u0441\u044c \u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u0435", "creation_timestamp": "2026-09-16T13:00:05.563983Z"}, {"uuid": "f8772abb-2223-430b-8091-0a893cada7cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/techoverload.bsky.social/post/3mvnat7u5pt22", "content": "CISA says attackers are exploiting CVE-2026-85706, a maximum-severity path traversal flaw in self-managed GitLab. If you run GitLab CE or EE, patch now and check exposed servers for signs of compromise\u2014this has moved past a theoretical bug. \ud83d\udd12\n\n#Security #GitLab #SelfHosting", "creation_timestamp": "2026-09-16T13:32:22.182786Z"}, {"uuid": "7ec0a493-1989-4d59-b5b7-f69000d2ad25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/serena666.bsky.social/post/3mvnmlfcyzp2c", "content": "CVE-2026-85706: Unauthenticated attackers reading *any* file, including secrets, from GitLab with one HTTP request. That's a brutally elegant path traversal. Patch now, folks.", "creation_timestamp": "2026-09-16T17:02:45.176121Z"}, {"uuid": "71410586-7283-454b-b19e-d91ac1ac438c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvp22ftku72p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 48 interactions\nCVE-2026-76461: 16 interactions\nCVE-2026-82078: 15 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-76460: 10 interactions\nCVE-2026-91843: 9 interactions\nCVE-2026-76461: 8 interactions\n", "creation_timestamp": "2026-09-17T06:36:26.215976Z"}, {"uuid": "7100307c-cc41-4257-ab66-58b2d1f57afc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/billingsley.bsky.social/post/3mvp7f2hl4m2g", "content": "COGNOSCERE Tech Brief \u2014 2026-09-17\n\nGitLab's CVSS 10.0 path traversal flaw, CVE-2026-85706, lets unauthenticated att\n\nhttps://youtube.com/watch?v=10k7TV2ewX0\n\nhttps://www.cognoscerellc.com/news", "creation_timestamp": "2026-09-17T08:11:52.536463Z"}, {"uuid": "7aecd289-a96e-408a-97d6-b403d033e529", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/sREDAe6BOKB9_RGSs3URiy3vPAWvfip9ao8nlCE9pHlx5C0", "content": "", "creation_timestamp": "2026-09-18T04:00:05.456277Z"}, {"uuid": "41fb3897-656c-4649-9b71-a56a58ca5a3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvrkgvh6cb2s", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 48 interactions\nCVE-2026-76460: 18 interactions\nCVE-2026-76461: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-58704: 10 interactions\nCVE-2026-76460: 8 interactions\nCVE-2023-28252: 3 interactions\n", "creation_timestamp": "2026-09-18T06:35:06.546016Z"}, {"uuid": "d93db30b-1611-4815-b99a-b5d89f2ced29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102627", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-PoC-Toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-18 03:56:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83e\udeac CVE-2026-85706 \u2013 GitLab Unauth File Read Toolkit (CVSS 10.0) | Red/Blue Team suite for self-managed GitLab CE/EE 18.7\u201319.3.1. 2 tools: Full Exploit (unauth file read, admin token, mass scan, loot, shell, stealth, SQLite/HTML/JSON output) etc., SafeChecker (version detect, audit, security headers, TLS check, MITRE). Only Use Ethically, Educ. <3\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-18T08:00:06.245274Z"}, {"uuid": "f947695d-04fc-4e97-88ff-8833265a7632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.cert.se/2026/09/cert-se-veckobrev-v38.html", "content": "", "creation_timestamp": "2026-09-18T12:15:06.312671Z"}, {"uuid": "bd6fdc86-7035-4a58-9820-21a0135036fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-gitlab-ce/ee", "content": "", "creation_timestamp": "2026-09-18T12:45:22.790421Z"}, {"uuid": "c6047e81-6fe4-44dd-b790-db7500700e26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/theitnerd.ca/post/3mvsxuuvx2j2i", "content": "Gitlab vulnerability addressed by Abstract ASTRO research\u00a0team\n\nAbstract's ASTRO research team published a blog last night entitled CVE-2026-85706: Detecting GitLab's Unauthenticated File Read in Your Logs\u2026...", "creation_timestamp": "2026-09-18T20:08:11.965531Z"}, {"uuid": "34bdca9b-308c-44c7-98ee-905d0ce9d999", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvu2roi4lx2y", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 38 interactions\nCVE-2026-58704: 21 interactions\nCVE-2026-76460: 19 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-39964: 12 interactions\nCVE-2026-53266: 9 interactions\nCVE-2026-58704: 7 interactions\n", "creation_timestamp": "2026-09-19T06:32:45.619809Z"}, {"uuid": "03647934-cc0a-4b64-93b3-9d390c47997f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/49236", "content": "CVE-2026-85706   GitLab CE/EE\n*\nVersion:  18.7\u201319.1.7, 19.2.0\u201319.2.5, 19.3.0\u201319.3.1\n*\nexploit", "creation_timestamp": "2026-09-19T10:00:04.433473Z"}, {"uuid": "4e1f45d3-14ec-46ef-ae12-2508a0fabe6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvvekxjbyc2y", "content": "\ud83d\udd34 GitLab CVE-2026-85706\n\nCritical CVSS 10.0 path traversal allows unauthenticated arbitrary file reads. CISA KEV lists the flaw as exploited.\n\nstemshop.top/blog/gitlab-...\n\n#CVE #CVE202685706 #GitLab #KEV #CyberSecurity", "creation_timestamp": "2026-09-19T19:00:47.858246Z"}, {"uuid": "284be68e-ccff-4f76-a0b2-c0a9f0826266", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvwmipih4f2p", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 33 interactions\nCVE-2026-58704: 21 interactions\nCVE-2026-76460: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2025-62593: 4 interactions\nCVE-2026-19478: 4 interactions\nCVE-2026-13348: 3 interactions\n", "creation_timestamp": "2026-09-20T06:55:11.866794Z"}, {"uuid": "3bc4b8c0-3947-4230-b514-1be3824c809f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvz5ffrwcj2k", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 32 interactions\nCVE-2026-58704: 21 interactions\nCVE-2026-76460: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-33818: 8 interactions\nCVE-2026-39821: 8 interactions\nCVE-2026-56853: 8 interactions\n", "creation_timestamp": "2026-09-21T07:02:53.980520Z"}, {"uuid": "53554e71-87af-43d6-8866-9546d0b33092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mvzalrcl6d2o", "content": "GitLab CVE-2026-85706 (CVSS 10.0): unauthenticated attackers read ANY file off self-managed servers, no login needed. Exploited within hours of the Sep 10 patch. CISA KEV. Patch to 19.3.2/19.2.6/19.1.8 now.\n\ud83c\uddec\ud83c\udde7 diesec.com/2026/09/gitl...\n\ud83c\udde9\ud83c\uddea diesec.com/de/2026/09/g... \n#cybersecurity", "creation_timestamp": "2026-09-21T08:00:08.821365Z"}, {"uuid": "700910de-c2ae-479c-8b37-f16c50972085", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mw3mtrjgoo2v", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85706: 27 interactions\nCVE-2026-76460: 22 interactions\nCVE-2026-58704: 21 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85046: 8 interactions\nCVE-2026-85880: 8 interactions\nCVE-2026-87491: 8 interactions\n", "creation_timestamp": "2026-09-22T06:44:41.332884Z"}, {"uuid": "df950a12-7b98-4209-a39b-8f97d367a1b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85709", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8", "content": "", "creation_timestamp": "2026-09-22T22:35:22.024446Z"}, {"uuid": "50126494-c1ba-4bf9-a54c-c8270db69204", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85709", "type": "seen", "source": "https://gist.github.com/alon710/74e359aa08359ada7f9cbef0f754a03e", "content": "# CVE-2026-85709: CVE-2026-85709: Sensitive Information Exposure in LightRAG API Server\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85709\n\n## Summary\nCVE-2026-85709 is a sensitive information exposure vulnerability in HKUDS LightRAG prior to version 1.5.5. The vulnerability allows remote, unauthenticated clients to trigger server-side errors and receive raw Python exception details, including local filesystem paths, database connection strings, credentials, and internal system configurations.\n\n## TL;DR\nImproper error handling in LightRAG's FastAPI server prior to version 1.5.5 permits unauthenticated network clients to leak highly sensitive infrastructure details, including absolute filesystem paths and database host parameters, by triggering raw exception traces.\n\n## Technical Details\n\n- **CWE ID**: CWE-209\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: No Public Exploits\n- **Impact**: Partial Confidentiality Leak\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- HKUDS LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade LightRAG to version 1.5.5 or higher.\n- Enforce API authentication using the LIGHTRAG_API_KEY environment variable.\n- Implement network-level access control lists to block public access to the API port (default 9621).\n\n**Remediation Steps:**\n1. Terminate the active LightRAG API server instance.\n2. Upgrade the local package dependency using 'pip install --upgrade lightrag>=1.5.5'.\n3. Configure the 'LIGHTRAG_API_KEY' environment variable to mandate authentication across all routes.\n4. Restart the API server and verify that failed endpoints output only sanitized correlation IDs.\n\n## References\n\n- [GitHub Security Advisory GHSA-hrmj-7rvj-4hg8](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8)\n- [LightRAG Pull Request #3422](https://github.com/HKUDS/LightRAG/pull/3422)\n- [LightRAG Release v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n- [Fix Commit: Centralized Sanitization Helper](https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47)\n- [Fix Commit: Chunking 422 Sanitization](https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364)\n- [NVD CVE-2026-85709 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-85709)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85709) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T11:32:02.878702Z"}, {"uuid": "505d1b99-3bea-4c78-a2e3-f71808157ea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103505", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-85706\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a unh00k3d\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 08:57:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706 \u2014 GitLab unauthenticated arbitrary file read (CVSS 10.0). Root-cause analysis, vulnerable Docker lab, and PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-27T09:00:08.000000Z"}, {"uuid": "9b350488-471e-4ce0-9122-1611bc64539c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwka4lsqb22r", "content": "\ud83d\udd34 GitLab CVE-2026-85706 \u2014 active exploitation\n\nCritical CVSS 10.0 path traversal can expose CI/CD secrets, deploy tokens, SSH keys and cloud credentials. Internet scanning began just one day after the patch.\n\nstemshop.top/blog/gitlab-...\n\n#CVE #CVE202685706 #GitLab #CyberSecurity #DevSecOps", "creation_timestamp": "2026-09-28T02:06:59.630296Z"}, {"uuid": "6cc587ba-578e-40e2-9ac0-617875a93e5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/trinity.sh/post/3mwkrzqx2hk2c", "content": "CVE-2026-85706: GitLab shipped fixes Sept 10 for a CVSS 10.0 path traversal in the repo commits API. In-the-wild probes same day. CISA added it to KEV \u2014 3 day deadline.\n\nhttps://trinity.sh/posts/2026-09-28-gitlab-cve-2026-85706-patch-to-kev/", "creation_timestamp": "2026-09-28T07:27:27.189685Z"}, {"uuid": "5542b571-ef6e-4400-93e0-1decc5c6bc4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/information_security_channel/55996", "content": "CVE-2026-85706: GitLab Unauthenticated Arbitrary File Read via the Repository Commits API\nhttps://www.offsec.com/blog/cve-2026-85706/\n\nCVE-2026-85706 is a critical, unauthenticated path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). \nThe post CVE-2026-85706: GitLab Unauthenticated Arbitrary File Read via the Repository Commits API (https://www.offsec.com/blog/cve-2026-85706/) appeared first on OffSec (https://www.offsec.com/).", "creation_timestamp": "2026-09-28T17:48:40.000000Z"}, {"uuid": "77528bc0-8a17-4c45-a3bc-d4598fb0ebad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/information_security_channel/55996", "content": "CVE-2026-85706: GitLab Unauthenticated Arbitrary File Read via the Repository Commits API\nhttps://www.offsec.com/blog/cve-2026-85706/\n\nCVE-2026-85706 is a critical, unauthenticated path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). \nThe post CVE-2026-85706: GitLab Unauthenticated Arbitrary File Read via the Repository Commits API (https://www.offsec.com/blog/cve-2026-85706/) appeared first on OffSec (https://www.offsec.com/).", "creation_timestamp": "2026-09-28T17:48:40.000000Z"}, {"uuid": "9ab192da-c952-4fe1-bba1-c6e21a9144d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "content": "", "creation_timestamp": "2026-09-28T15:00:07.000000Z"}, {"uuid": "d675f4a3-097a-403d-b825-3c650e0770cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/a0lInPmLZT-AAvB7437Ja2Nu6R6ocGw-E_CDkzhUlRx1eTo", "content": "", "creation_timestamp": "2026-09-28T15:00:07.000000Z"}, {"uuid": "cc17f404-b70f-4357-968a-b2df8a297b76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "Telegram/nFA00ixIsgHyNXSNZE1vxHvOwqh4w7VlKhPXveJ41Rvetmc", "content": "", "creation_timestamp": "2026-09-29T04:13:29.000000Z"}, {"uuid": "07eda99a-41f4-4095-ba0f-765c17f5f4fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/tracyragan.bsky.social/post/3mwnyrq5hf22c", "content": "A CVE GitLab users should know about: CVE-2026-85706, an attacker can abuse the repo commits API to make GitLab read arbitrary files from the server, potentially exposing sensitive files, credentials, configuration, or secrets. GitLab issued emergency fixes on September 10. https://cstu.io/b51b4b", "creation_timestamp": "2026-09-29T14:06:13.875995Z"}, {"uuid": "2f3511f3-0510-41e6-a8c0-71c5bdc19d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/wordfencenews.bsky.social/post/3mwolyqhjec25", "content": "GitLab Patches Critical Unauthenticated Path Traversal Flaw | CVE-2026-85706\n\nFollow for more weekly cybersecurity news\n\n#cybersecurity #cybersecuritynews", "creation_timestamp": "2026-09-29T19:50:15.640139Z"}, {"uuid": "811caf3d-0545-488e-bbca-47eefb0a243a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/orteliusos.bsky.social/post/3mwpo4e7vah2d", "content": "A CVE GitLab users should know about: CVE-2026-85706, an attacker can abuse the repo commits API to make GitLab read arbitrary files from the server, potentially exposing sensitive files, credentials, configuration, or secrets. GitLab issued emergency fixes on September 10. https://cstu.io/b51b4b", "creation_timestamp": "2026-09-30T06:00:38.771376Z"}, {"uuid": "a4983d44-2ba0-49c1-8d45-ca8d9c943e33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mwqeymb6no2x", "content": "\ud83d\udd17 CVE : CVE-2026-85706, CVE-2026-87719", "creation_timestamp": "2026-09-30T12:50:08.676957Z"}, {"uuid": "d29e9c80-53f1-4a0f-9664-fa8622335ace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mws6cf2wxv2f", "content": "\u2022 GitLab (CVE-2026-85706) et Apple (CVE-2026-86950) : avis CERT-FR, vuln\u00e9rabilit\u00e9s activement exploit\u00e9es. Patchez vite.\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1242/\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1236/", "creation_timestamp": "2026-10-01T05:55:39.857284Z"}, {"uuid": "e0d427ff-22b1-4b7f-b6b7-fdab1967cb25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mwybzkffmh22", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab to read arbitrary server files, with confirmed in-the-wild exploitation and a CVSS 10.0 impact.\n", "creation_timestamp": "2026-10-03T16:18:17.185496Z"}, {"uuid": "740ea2ce-cd23-4bcb-80c5-fa83e9ea51c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwyc2q546e2j", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab to read arbitrary server files, with confirmed in-the-wild exploitation and a CVSS 10.0 impact.\n", "creation_timestamp": "2026-10-03T16:18:56.565255Z"}]}