{"vulnerability": "cve-2026-85706", "sightings": [{"uuid": "43f23a02-1153-4e54-8710-f98b4fb740e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mv7c2savxc2e", "content": "GitLab patched critical GitLab vulnerabilities, led by CVE-2026-85706 with a CVSS 10.0 score. Update your server now to protect source code from exposure.\n\n#GitLab #CVE202685706 #Vulnerabilities #DevSecOps #Cybersecurity\nsecurityonline.info/gitlab-vulne...", "creation_timestamp": "2026-09-11T00:17:16.620039Z"}, {"uuid": "717312b2-7e45-4a86-868a-2a30fd1fb1d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/whatsnew.fyi/post/3mv7ooemhtb2t", "content": "GitLab\n\nFix path traversal issue in repository commits API that allowed unauthenticated users to read arbitrary files from the GitLab server (CVE-2026-85706)", "creation_timestamp": "2026-09-11T04:02:56.023323Z"}, {"uuid": "c42e3b9d-05b5-4b5e-804b-a18c06affaad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvajsegf4v25", "content": "GitLab Patches CVE-2026-85706: Path Traversal CVSS 10.0 in Self-Managed Instances", "creation_timestamp": "2026-09-11T12:08:20.582383Z"}, {"uuid": "eedfd42e-9e66-4ba4-a8a4-f95aeaad6491", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]", "creation_timestamp": "2026-09-11T13:00:37.738975Z"}, {"uuid": "499015f1-f450-447f-9b73-0accf6a304f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvandi6jbm2p", "content": "\ud83e\udd16 CVE-2026-85706 (max severity): path traversal in GitLab CE/EE. GitLab urges admins to patch their servers immediately.\nhttps://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "creation_timestamp": "2026-09-11T13:11:36.812771Z"}, {"uuid": "d843f59f-bfc2-46c3-b233-0ba6b638fce2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mvanna6twm2d", "content": "Critical GitLab Vulnerabilities Exposed: Deep Dive into the CVSS 10.0 Path Traversal (CVE-2026-85706) & GraphQL\u00a0Exploits\n\nGitLab fixes CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal flaw, alongside\u2026\n\nhttps://thecybersecguru.com/news/gitlab-cve-2026-85706-cvss-10-path-traversal/", "creation_timestamp": "2026-09-11T13:17:10.628123Z"}, {"uuid": "02f233a2-055a-433c-b5b1-d3eb2aebde0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/jbhall56/statuses/117252784631494872", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "creation_timestamp": "2026-09-11T14:05:08.778053Z"}, {"uuid": "69f96e27-9ad4-4d13-903c-13115a6ae2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mvaq2esev62q", "content": "\ud83d\udd17 CVE : CVE-2024-11222, CVE-2025-14871, CVE-2026-1168, CVE-2026-12910, CVE-2026-13210, CVE-2026-16794, CVE-2026-19619, CVE-2026-3855, CVE-2026-7514, CVE-2026-78252, CVE-2026-79708, CVE-2026-8030, CVE-2026-82837, CVE-2026-85706, CVE-2026-86340, CVE-2026-86341, CVE-2026-87719, CVE-2026-88765", "creation_timestamp": "2026-09-11T14:00:11.819453Z"}, {"uuid": "75dd2e9f-a009-4956-be63-de3fed078843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/jbhall56.bsky.social/post/3mvaqdgw3sk23", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. www.bleepingcomputer.com/news/securit...", "creation_timestamp": "2026-09-11T14:05:17.070830Z"}, {"uuid": "6bdf8cdb-c986-4611-8f62-1dc20ad2a8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mvatuco6p326", "content": "\ud83d\udcf0 GitLab Desak Pengguna Segera Menambal Celah Path Traversal Kritikal CVE-2026-85706\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/11/gitlab-cve-2026-85706-path-traversal/\n\n#cybersecurity #dataBreach #gitlab #keamanan #keamananSiber #kebocoranData #vulnerability", "creation_timestamp": "2026-09-11T15:08:22.740889Z"}, {"uuid": "49eeda29-a41d-4b2c-b1e4-ebd15c929ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvatugztyz2z", "content": "\ud83d\udcf0 GitLab Desak Pengguna Segera Menambal Celah Path Traversal Kritikal CVE-2026-85706\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/11/gitlab-cve-2026-85706-path-traversal/\n\n#potatosecurity #dataBreach #gitlab #keamanan #keamananSiber #kebocoranData #vulnerability", "creation_timestamp": "2026-09-11T15:08:27.075820Z"}, {"uuid": "1657a614-e5a6-4b74-a02e-461673183973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvaxudfxcs2t", "content": "GitLab\u306e\u8106\u5f31\u6027\u3001\u516c\u958b\u304b\u3089\u308f\u305a\u304b1\u65e5\u3067\u60aa\u7528\u3055\u308c\u308b\n\n\u653b\u6483\u5bfe\u8c61\u9818\u57df\u7ba1\u7406(ASM)\u4f01\u696d\u306eWatchTowr\u306b\u3088\u308b\u3068\u3001\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304cGitLab\u3067\u65b0\u305f\u306b\u4fee\u6b63\u3055\u308c\u305f\u8106\u5f31\u6027\u3092\u3001\u516c\u958b\u304b\u3089\u308f\u305a\u304b1\u65e5\u3067\u60aa\u7528\u3057\u59cb\u3081\u3066\u3044\u308b\u3053\u3068\u304c\u8b66\u544a\u3055\u308c\u3066\u3044\u307e\u3059\u3002 CVE-2026-85706(CVSS\u30b9\u30b3\u30a210/10)\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u30e6\u30fc\u30b6\u30fc\u304cGitLab\u30b5\u30fc\u30d0\u30fc\u4e0a\u306e\u4efb...", "creation_timestamp": "2026-09-11T16:19:59.166410Z"}, {"uuid": "21241cd9-61d9-41ff-896f-d1a895ce7210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102028", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #EXP\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706_docker_exp\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FlowerWitch\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 11:59:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706_docker_exp\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T16:00:04.571579Z"}, {"uuid": "e743cbf4-8fe2-45e7-be45-2be6056e6c8c", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b07d40c1-522c-40bb-8f2b-55076a002453", "content": "", "creation_timestamp": "2026-09-11T20:00:02.742474Z"}, {"uuid": "54f743d3-742c-4e0d-b905-e91586ee8930", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvay6abomo2g", "content": "A critical GitLab path traversal flaw (CVE-2026-85706) is being exploited in the wild, enabling unauthenticated arbitrary file reads; upgrade immediately.\n", "creation_timestamp": "2026-09-11T16:25:32.660395Z"}, {"uuid": "f1006b28-252b-4aa8-b86b-5ec5361eb902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvay6bxxza2l", "content": "GitLab\u306b\u6700\u5927\u6df1\u523b\u5ea6\u306e\u30d1\u30b9\u30fb\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027 (CVE-2026-85706) \u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u30e6\u30fc\u30b6\u30fc\u306f\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u9069\u7528\u304c\u5fc5\u8981\u3067\u3059\u3002", "creation_timestamp": "2026-09-11T16:25:33.948197Z"}, {"uuid": "65671694-bd1b-4f45-b3a0-17882c4417d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvay7bg4b42v", "content": "A critical GitLab path traversal flaw (CVE-2026-85706) is being exploited in the wild, enabling unauthenticated arbitrary file reads; upgrade immediately.\n", "creation_timestamp": "2026-09-11T16:26:05.912098Z"}, {"uuid": "4b1f0d1e-9e36-4abb-acc8-9b192e228ddd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mvaycrguvb22", "content": "\ud83d\udea8GitLab releases 19.3.2, 19.2.6, 19.1.8 patch 2 critical CVEs:\n\nCVE-2026-85706: A 10.0 arbitrary file read via unauth path traversal in repo commits API, affecting CE and EE versions from 18.7.\n\nCVE-2026-87719: A 9.9 insecure deserialization via GraphQL subscription, affecting EE versions from 18.3.", "creation_timestamp": "2026-09-11T16:28:03.839124Z"}, {"uuid": "2bfc13c5-0b26-4a3b-8f07-10b6cf891201", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvayn2vxh52f", "content": "Critical CVSS 10 GitLab file-read flaw (CVE-2026-85706) under active exploit \u2014 upgrade now. #GitLab #Security #Vulnerability #CVSS10 #Cybersecurity #DevSecOps thedailytechfeed.com/gitlab-patch...", "creation_timestamp": "2026-09-11T16:33:49.771379Z"}, {"uuid": "f7072d26-41ae-47b1-a773-1f89fbc1bc85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvazbwc2jw2q", "content": "GitLab patched CVE-2026-85706, a max-severity path traversal flaw that could expose credentials and sensitive data. watchTowr also reported early probing against exposed GitLab systems. #GitLab #CVE-2026-85706 #watchTowr", "creation_timestamp": "2026-09-11T16:45:28.953985Z"}, {"uuid": "926e10e1-bc35-47f3-b6a6-8ffa0201ab03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117253536124011388", "content": "\ud83d\udcf0 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability\nGitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-11T17:16:16.685986Z"}, {"uuid": "5090427b-7ea4-4ef9-85be-19eb1252c5b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvb2zej7xf2i", "content": "GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-11T17:16:28.973932Z"}, {"uuid": "2945ec77-93c8-44ab-a0b8-47e6e1118dad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117253567771400768", "content": "\ud83d\udea8 GitLab CVSS 10 vulnerability exploited just one day after disclosure\nThreat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.\u2800The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.\nAffected versions include:\n\u2022 GitLab 18.7 through versions before 19.1.8\u2022 GitLab 19.2 through versions before 19.2.6\u2022 GitLab 19.3 through versions before 19.3.2\u2800GitLab disclosed and patched the vulnerability on September 10.\nJust one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.\u2800Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.\nGitLab.com is already patched.\nSource: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "creation_timestamp": "2026-09-11T17:24:18.188298Z"}, {"uuid": "68719fc1-1833-400a-b00e-171106fe6f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117253591041343887", "content": "\ud83d\udea8 CVE-2026-85706: An unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7\u201319.1.7; 19.2.0\u201319.2.5; 19.3.0\u201319.3.1\nPoC: https://github.com/guneykabel/cve-2026-85706", "creation_timestamp": "2026-09-11T17:30:13.249156Z"}, {"uuid": "85842eed-947c-4896-b50c-3b1024befa44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mvb45g4e4t2t", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab repository commits API, allowing arbitrary file reads and credential exposure via in-the-wild probes.\n", "creation_timestamp": "2026-09-11T17:36:39.232556Z"}, {"uuid": "a7421f4f-c327-4a58-ac18-9631c9e774f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mvb4b3dzop23", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab repository commits API, allowing arbitrary file reads and credential exposure via in-the-wild probes.\n", "creation_timestamp": "2026-09-11T17:38:41.611456Z"}, {"uuid": "6246f819-f41c-46c5-9adc-fee1ce393407", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvb4bcecvt2g", "content": "CVE-2026-85706 enables unauthenticated path traversal in GitLab repository commits API, allowing arbitrary file reads and credential exposure via in-the-wild probes.\n", "creation_timestamp": "2026-09-11T17:38:49.159978Z"}, {"uuid": "9cba1cce-c46d-43c5-8fb8-825a97dd7e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/true_secator/8604", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 0-day \u0432 Chrome. CVE-2026-87491 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8. \u042d\u0442\u043e \u0441\u0435\u0434\u044c\u043c\u0430\u044f 0-day \u0432 Chrome, \u043a\u043e\u0442\u043e\u0440\u0443\u044e Google \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443.\n\n2. IonQ \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043b\u0443\u0447\u0448\u0438\u0435 \u043a\u0432\u0430\u043d\u0442\u043e\u0432\u044b\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0441\u043c\u043e\u0433\u0443\u0442 \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0438\u0442\u043a\u043e\u0438\u043d\u0430 \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0437\u0430 26 \u0434\u043d\u0435\u0439.\n\n3. \u0410\u0433\u0435\u043d\u0442\u044b OpenAI, \u0432\u044b\u0440\u0432\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0438\u0437 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0440\u0435\u0434 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0435\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u0431\u0435\u0441\u0435\u0434\u044b \u043f\u043e\u0447\u0442\u0438 \u043d\u0430 \u0434\u0435\u0441\u044f\u0442\u043a\u0435 \u0441\u0430\u0439\u0442\u043e\u0432 \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 GitHub, \u0441\u0430\u0439\u0442\u044b pastebin, \u0441\u0430\u0439\u0442 \u043f\u0440\u0435\u043f\u043e\u0434\u0430\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e \u0445\u0438\u043c\u0438\u0438 AP \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0441\u044b\u043b\u043e\u043a.\n\n4. \u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u043e\u0432 Trezor \u0438 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n5. GitLab \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 - CVE-2026-85706. \n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0443\u0442\u0438 \u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0444\u0438\u043a\u0441\u0430\u0446\u0438\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438.\n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u00ab\u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445\u00bb. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432\u0442\u043e\u0440\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e CVE-2026-87719, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0432 GraphQL.\n\n6. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043b Deep-Live-Cam, \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043b\u0438\u0446 \u043d\u0430 Python \u0441 96 600 \u0437\u0432\u0435\u0437\u0434\u0430\u043c\u0438 \u043d\u0430 GitHub. \u041e\u043d \u0438\u0437\u043c\u0435\u043d\u0438\u043b \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0434\u043b\u044f Windows \u0438 macOS. \u0412\u0437\u043b\u043e\u043c \u0434\u043b\u0438\u043b\u0441\u044f \u0432\u0441\u0435\u0433\u043e \u0434\u0435\u0432\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432.\n\n7. Apple \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u043b\u0438\u043d\u0435\u0439\u043a\u0443 \u0443\u043c\u043d\u044b\u0445 \u0447\u0430\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u044b \u0436\u0443\u0442\u043a\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043f\u043e\u0434\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u043e\u043a\u0440\u0443\u0433 \u0432 \u043b\u044e\u0431\u043e\u0435 \u0432\u0440\u0435\u043c\u044f, \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u044b, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u0445 \u0434\u043b\u044f \u043a\u0430\u043b\u0435\u043d\u0434\u0430\u0440\u044f, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0434\u0430\u0447.\n\n8. LG \u0432\u0441\u044f\u0447\u0435\u0441\u043a\u0438 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438 \u0441\u043c\u0430\u0440\u0442-\u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440\u044b \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f\u0445. \u0412\u0435\u0440\u0438\u043c.\n\n9. Anthropic \u0441\u043e\u0437\u0434\u0430\u043b\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441\u043b\u0435\u0436\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0438\u0446 \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0441\u0442\u043e\u0432, \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u0418\u0418 \u0438 \u0426\u041e\u0414\u043e\u0432.\n\n10. \u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 F5 BIG-IP APM \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 PHP-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0431\u0435\u0437 \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u044c, \u0438\u0437\u0431\u0435\u0433\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0434\u0438\u0441\u043a.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u0434\u0438\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u044b\u043b\u0430 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2025-53521, \u043a\u043e\u0442\u043e\u0440\u0443\u044e\u00a0\u0432 \u043c\u0430\u0440\u0442\u0435 \u043f\u0435\u0440\u0435\u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b DoS \u0432 RCE.\n\nSophos \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u0440\u0430\u0437\u0435\u0446 \u0438 \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0430, \u0447\u0442\u043e \u0442\u043e\u0442 \u0436\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d ESET, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0435\u0433\u043e \u043a\u0430\u043a PoisonedRefresh.\n\n11. Check Point \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u0430\u043d\u0430\u043b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 ChatGPT \u043f\u043e\u0434 \u043e\u0434\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0438 \u0432 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u043f\u043e\u0434 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e. \u0418 \u044d\u0442\u043e \u043d\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438 \u043d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438. [\u00a0Check Point\u00a0]\n\n12. Onapsis \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0435\u0442\u044b \u043e \u0434\u0432\u0443\u0445 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043a\u0430\u0445, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 SAP: OVERPASS - \u044d\u0442\u043e RCE \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 SAP (CVE-2026-44756) \u0438 S4GET - \u044d\u0442\u043e RCE \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SAP NetWeaver (CVE-2026-58240). \u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043c\u0435\u044e\u0442 \u043e\u0447\u0435\u043d\u044c \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 CVSS \u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u0443\u0434\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n13. Adobe \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f 0-day StyleSmuggler, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u043d\u0430 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u044b Magento \u0438 Adobe Commerce. \u0422\u0435\u043f\u0435\u0440\u044c \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-75650.\n\n14. N-able \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 0-day \u0432 N-central - CVE-2026-86218, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0434\u0432\u0443\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043f\u044f\u0442\u043d\u0438\u0446\u0443. \u0420\u0430\u043d\u0435\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f N-central \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u0438\u0441\u044c 0-day \u0430\u0442\u0430\u043a\u0430\u043c.", "creation_timestamp": "2026-09-11T18:00:06.027177Z"}, {"uuid": "c43c4b6d-1d87-4f29-81e8-011ff64cf9f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/thehackernews/10039", "content": "\u203c\ufe0f GitLab\u2019s CVSS 10 file-read flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure.\n\nIf an instance has at least one public project, unauthenticated attackers can read logs and config files containing credentials and secrets.\n\nRead: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-11T19:00:04.282592Z"}, {"uuid": "0f0f92d0-9df6-4204-9d67-7ea0a86bf575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhtsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 16:42:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGitLab CE/EE unauthenticated arbitrary file read (CVE-2026-85706) - PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T19:00:05.439545Z"}, {"uuid": "5417ba67-f99d-4e28-8f08-a2331f0c3d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mvbcicyf6h2m", "content": "\ud83d\udce2 GitLab corrige une faille critique de path traversal (CVE-2026-85706) dans l'API commits\n\nL'article couvre la divulgation et le correctif de deux vuln\u00e9rabilit\u00e9s critiques affectant la plateforme GitLab. \ud83d\udd34 Vuln\u00e9rabilit\u00e9\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#GitLab #PathTraversal #Cyberveille", "creation_timestamp": "2026-09-11T19:30:06.466342Z"}, {"uuid": "1b97ec29-a875-4cbc-9d68-aa716a39ce43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mvbco7clr42x", "content": "GitLab put out a critical patch on 10 September for CVE-2026-85706, CVSS 10.0, an unauthenticated path traversal in the commits API that reads config files and secrets off self-managed servers. watchTowr saw probing begin at 06:00 UTC today. docs.gitlab.com/releases...", "creation_timestamp": "2026-09-11T19:33:24.050051Z"}, {"uuid": "4abf36b8-1f71-4680-9963-ea3d1c7f3400", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/117254163583104386", "content": "CVE-2026-85706 is now in the KEV but the CVE still isn't published. LMAO. Go hack and patch more GitLab shit.", "creation_timestamp": "2026-09-11T19:55:49.617034Z"}, {"uuid": "830bc6a6-bfb1-4a6a-9524-5d2c04164f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "content": "GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.\n\nThe vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under", "creation_timestamp": "2026-09-11T19:00:37.202898Z"}, {"uuid": "f87eba42-ebb5-494f-9656-8b95c474cc56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvbb7iiclr2j", "content": "Patch GitLab now \u2014 CVE-2026-85706 (CVSS 10.0) unauthenticated path traversal under active in-the-wild probing. Fix: 19.1.8/19.2.6/19.3.2. https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-11T19:07:16.360028Z"}, {"uuid": "a3242d2f-19c7-470c-97ad-10bde0ff8ded", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvbe6oqqun2n", "content": "GitLab patched CVE-2026-85706, a CVSS 10 path traversal flaw in the commits API that is already seeing probes and could expose arbitrary files. CVE-2026-87719 also fixed in GitLab EE. #GitLab #CVE202685706 #CVE202687719", "creation_timestamp": "2026-09-11T20:00:31.398618Z"}, {"uuid": "3fddfab9-f48a-4e97-a474-6da795ed4484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mvbeyo43zi2y", "content": "\ud83d\uded1 CVE-2026-85706\nGitLab Community Edition and Enterprise Edition\nKEV \u2705\nTL;DR: GitLab Community Edition and Enterprise Edition contains a path traversal vulnerab\u2026\nhttps://cvesentinel.com/report/CVE-2026-85706?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-11T20:15:03.016747Z"}, {"uuid": "3585a431-e3e9-403e-a8f4-aeef584ffba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvbezdpt7s2l", "content": "GitLab CVE-2026-85706 was exploited within a day of disclosure. The critical path traversal flaw (CVSS 10.0) can let unauthenticated attackers read arbitrary files. #GitLab #CVE202685706 #PathTraversal", "creation_timestamp": "2026-09-11T20:15:25.972265Z"}, {"uuid": "fa779750-5e14-4190-a79d-a3c837b518e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyberupdates365.bsky.social/post/3mvbfklda3k2q", "content": "\ud83d\udea8 Critical GitLab flaw: CVE-2026-85706 carries a CVSS 10.0 score.\n\nUnder vulnerable conditions, an unauthenticated attacker could read arbitrary files from a self-managed GitLab server.\n\ntechupdate24.com/gitlab-cve-2...\n\n#GitLab #InfoSec #git #news", "creation_timestamp": "2026-09-11T20:25:07.875599Z"}, {"uuid": "36d237d5-ea86-4f89-a70a-bc1e3ca73fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvbim3efjw27", "content": "\ud83e\udd16 CVE-2026-85706 (CVSS 10.0): path traversal in GitLab's repository commits API lets unauthenticated users read arbitrary files. Patches released; in-the-wild probes seen within hours of disclosure.\n\nhttps://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-11T21:19:39.043475Z"}, {"uuid": "ca24a608-bf76-40fb-85e7-34b445a1be51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mvbmyyc3oq2v", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-85706: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-85706", "creation_timestamp": "2026-09-11T22:38:23.840869Z"}, {"uuid": "9a7f7c6b-2f0e-49b0-9e48-900ec871233e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mvbjy3cwau2z", "content": "GitLab released security updates on September 10, 2026, addressing critical vulnerabilities in Community and Enterprise Editions. CVE-2026-85706, a path traversal flaw, allows unauthenticated file reads with a CVSS score of 10.0. CVE-2026-87719, an insecure deserialization vulnerability, scores 9.", "creation_timestamp": "2026-09-11T21:44:12.563894Z"}, {"uuid": "d9c7c3b6-e066-49a8-bd20-7c6bcc7592f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvbk2afckt2n", "content": "GitLab rushed emergency patches for 2 critical flaws. CVE-2026-85706 can let unauthenticated attackers read files, while CVE-2026-87719 may expose settings and passwords. #GitLab #CVE202685706 #CISA", "creation_timestamp": "2026-09-11T21:45:24.569537Z"}, {"uuid": "dec7cb62-b987-4cff-9c8c-8beb58106685", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mvbngd2t2r24", "content": "GitLab patched CVE-2026-85706, a CVSS 10 path traversal flaw enabling unauthenticated file reads, as in-the-wild probes began.", "creation_timestamp": "2026-09-11T22:45:51.672123Z"}, {"uuid": "d27cc926-78cc-4c3b-9e92-5c79e202e2d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/GithubRedTeam/102079", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a solivaquaant\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 19:48:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-11T23:00:04.369918Z"}, {"uuid": "9bd5ac36-ff29-49ee-95dd-837988d236fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102079", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a solivaquaant\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 19:48:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-85706: GitLab CE/EE unauthenticated arbitrary local file read\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:09.517462Z"}, {"uuid": "5a4c3673-d83a-4b8f-9462-f74441a05747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mhtsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 16:42:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nGitLab CE/EE unauthenticated arbitrary file read (CVE-2026-85706) - PoC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:32.612614Z"}, {"uuid": "ce3ef671-151d-41d1-8254-de7a918f618c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/true_secator/8604", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0443\u0433\u0440\u043e\u0437\u044b:\n\n1. Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 0-day \u0432 Chrome. CVE-2026-87491 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8. \u042d\u0442\u043e \u0441\u0435\u0434\u044c\u043c\u0430\u044f 0-day \u0432 Chrome, \u043a\u043e\u0442\u043e\u0440\u0443\u044e Google \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443.\n\n2. IonQ \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442, \u0447\u0442\u043e \u043b\u0443\u0447\u0448\u0438\u0435 \u043a\u0432\u0430\u043d\u0442\u043e\u0432\u044b\u0435 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b \u0441\u043c\u043e\u0433\u0443\u0442 \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0438\u0442\u043a\u043e\u0438\u043d\u0430 \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0437\u0430 26 \u0434\u043d\u0435\u0439.\n\n3. \u0410\u0433\u0435\u043d\u0442\u044b OpenAI, \u0432\u044b\u0440\u0432\u0430\u0432\u0448\u0438\u0435\u0441\u044f \u0438\u0437 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0440\u0435\u0434 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u0435\u043b\u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u0431\u0435\u0441\u0435\u0434\u044b \u043f\u043e\u0447\u0442\u0438 \u043d\u0430 \u0434\u0435\u0441\u044f\u0442\u043a\u0435 \u0441\u0430\u0439\u0442\u043e\u0432 \u0431\u043e\u043b\u044c\u0448\u0435, \u0447\u0435\u043c \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u043e\u0441\u044c \u0440\u0430\u043d\u0435\u0435. \u0421\u0440\u0435\u0434\u0438 \u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 GitHub, \u0441\u0430\u0439\u0442\u044b pastebin, \u0441\u0430\u0439\u0442 \u043f\u0440\u0435\u043f\u043e\u0434\u0430\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e \u0445\u0438\u043c\u0438\u0438 AP \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0441\u0441\u044b\u043b\u043e\u043a.\n\n4. \u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u0440\u0438\u043f\u0442\u043e\u043a\u043e\u0448\u0435\u043b\u044c\u043a\u043e\u0432 Trezor \u0438 \u0440\u0430\u0437\u043e\u0441\u043b\u0430\u043b\u0438 \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n5. GitLab \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u044c\u044e \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 - CVE-2026-85706. \n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0443\u0442\u0438 \u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 API \u0434\u043b\u044f \u0444\u0438\u043a\u0441\u0430\u0446\u0438\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438.\n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u00ab\u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445\u00bb. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, GitLab \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432\u0442\u043e\u0440\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e CVE-2026-87719, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0432 GraphQL.\n\n6. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430\u043b Deep-Live-Cam, \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0437\u0430\u043c\u0435\u043d\u044b \u043b\u0438\u0446 \u043d\u0430 Python \u0441 96 600 \u0437\u0432\u0435\u0437\u0434\u0430\u043c\u0438 \u043d\u0430 GitHub. \u041e\u043d \u0438\u0437\u043c\u0435\u043d\u0438\u043b \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0434\u043b\u044f Windows \u0438 macOS. \u0412\u0437\u043b\u043e\u043c \u0434\u043b\u0438\u043b\u0441\u044f \u0432\u0441\u0435\u0433\u043e \u0434\u0435\u0432\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432.\n\n7. Apple \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043d\u043e\u0432\u0443\u044e \u043b\u0438\u043d\u0435\u0439\u043a\u0443 \u0443\u043c\u043d\u044b\u0445 \u0447\u0430\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0441\u043d\u0430\u0449\u0435\u043d\u044b \u0436\u0443\u0442\u043a\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043f\u043e\u0434\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u043e\u043a\u0440\u0443\u0433 \u0432 \u043b\u044e\u0431\u043e\u0435 \u0432\u0440\u0435\u043c\u044f, \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u044b\u0432\u0430\u0435\u0442 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u044b, \u0430 \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0438\u0445 \u0434\u043b\u044f \u043a\u0430\u043b\u0435\u043d\u0434\u0430\u0440\u044f, \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u0434\u0430\u0447.\n\n8. LG \u0432\u0441\u044f\u0447\u0435\u0441\u043a\u0438 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u0435\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430 \u0441\u0432\u043e\u0438 \u0441\u043c\u0430\u0440\u0442-\u0442\u0435\u043b\u0435\u0432\u0438\u0437\u043e\u0440\u044b \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0435\u0432 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f\u0445. \u0412\u0435\u0440\u0438\u043c.\n\n9. Anthropic \u0441\u043e\u0437\u0434\u0430\u043b\u0430 \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0441\u043b\u0435\u0436\u043a\u0438 \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u043b\u0438\u0446 \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0441\u0442\u043e\u0432, \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0442\u0438\u0432 \u0418\u0418 \u0438 \u0426\u041e\u0414\u043e\u0432.\n\n10. \u0425\u0430\u043a\u0435\u0440\u044b \u0432\u0437\u043b\u043e\u043c\u0430\u043b\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 F5 BIG-IP APM \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0440\u0443\u0442\u043a\u0438\u0442\u0430 Linux, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 PHP-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0432\u043d\u0435\u0434\u0440\u044f\u0442\u044c \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 \u0431\u0435\u0437 \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0432 \u043f\u0430\u043c\u044f\u0442\u044c, \u0438\u0437\u0431\u0435\u0433\u0430\u044f \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0434\u0438\u0441\u043a.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u0434\u0438\u0438 \u0430\u0442\u0430\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u044b\u043b\u0430 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u0430 \u043f\u043e\u0441\u043b\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2025-53521, \u043a\u043e\u0442\u043e\u0440\u0443\u044e\u00a0\u0432 \u043c\u0430\u0440\u0442\u0435 \u043f\u0435\u0440\u0435\u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0438\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b DoS \u0432 RCE.\n\nSophos \u043f\u0440\u043e\u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u0440\u0430\u0437\u0435\u0446 \u0438 \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0430, \u0447\u0442\u043e \u0442\u043e\u0442 \u0436\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u044b\u043b \u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d ESET, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0435\u0433\u043e \u043a\u0430\u043a PoisonedRefresh.\n\n11. Check Point \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u0430\u043d\u0430\u043b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 ChatGPT \u043f\u043e\u0434 \u043e\u0434\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0437\u0430\u0434\u0430\u0447\u0438 \u0432 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0441\u0441\u0438\u044e \u043f\u043e\u0434 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e. \u0418 \u044d\u0442\u043e \u043d\u0435 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438 \u043d\u0438 \u043e\u0434\u043d\u043e\u0439 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438. [\u00a0Check Point\u00a0]\n\n12. Onapsis \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0435\u0442\u044b \u043e \u0434\u0432\u0443\u0445 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043a\u0430\u0445, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 SAP: OVERPASS - \u044d\u0442\u043e RCE \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u044f\u0434\u0440\u0435 SAP (CVE-2026-44756) \u0438 S4GET - \u044d\u0442\u043e RCE \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 SAP NetWeaver (CVE-2026-58240). \u041e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043c\u0435\u044e\u0442 \u043e\u0447\u0435\u043d\u044c \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 CVSS \u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0431\u0443\u0434\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n13. Adobe \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f 0-day StyleSmuggler, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u043d\u0435\u0434\u0435\u043b\u0435 \u043d\u0430 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u044b Magento \u0438 Adobe Commerce. \u0422\u0435\u043f\u0435\u0440\u044c \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-75650.\n\n14. N-able \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 0-day \u0432 N-central - CVE-2026-86218, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 \u0434\u0432\u0443\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0432 \u043f\u0440\u043e\u0448\u043b\u0443\u044e \u043f\u044f\u0442\u043d\u0438\u0446\u0443. \u0420\u0430\u043d\u0435\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f N-central \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u043b\u0438\u0441\u044c 0-day \u0430\u0442\u0430\u043a\u0430\u043c.", "creation_timestamp": "2026-09-12T00:00:35.297089Z"}, {"uuid": "9b221745-ddae-43ca-8007-1a88bc55e2df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/uutis.bsky.social/post/3mvccmvxvb62y", "content": "Yhdysvaltain CISA on lis\u00e4nnyt tunnettujen hy\u00f6dynnettyjen haavoittuvuuksien listalleen kriittisen GitLab-puutteen CVE-2026-85706, jonka vakavuuspisteet ovat maksimaaliset 10.0.\n\n#yhdysvallat #kyberturvallisuus", "creation_timestamp": "2026-09-12T05:05:20.964989Z"}, {"uuid": "1b4fa540-5826-47d5-9c6b-2f55006462f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "exploited", "source": "https://t.me/thehackernews/10039", "content": "\u203c\ufe0f GitLab\u2019s CVSS 10 file-read flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure.\n\nIf an instance has at least one public project, unauthenticated attackers can read logs and config files containing credentials and secrets.\n\nRead: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-12T00:00:31.522114Z"}, {"uuid": "25f87473-a97e-4a05-8420-25d0a4f2cce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102028", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #EXP\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-85706_docker_exp\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a FlowerWitch\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-11 11:59:58\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-85706_docker_exp\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-12T00:00:36.454804Z"}, {"uuid": "3e3392e0-d489-4f9a-ac5c-10a5d0360ce1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-917", "content": "", "creation_timestamp": "2026-09-12T00:15:16.563291Z"}, {"uuid": "eca03e6d-449a-46ab-aabc-b967a2be4ff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.cert.se/2026/09/gitlab-rattar-kritiska-sarbarheter.html", "content": "", "creation_timestamp": "2026-09-12T00:15:18.802247Z"}, {"uuid": "750ef6dd-3001-4975-b0a1-63e68212cb7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvc7eydmuc2n", "content": "\ud83d\udea8 CVE-2026-85706 \u2014 CVSS 10 CRITICAL\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85706\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-12T04:07:14.187480Z"}, {"uuid": "8a2336c7-656d-4dff-aa30-99b3d36f9748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/", "content": "GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]", "creation_timestamp": "2026-09-12T01:00:38.738900Z"}, {"uuid": "84b123af-a9b7-4019-9cd6-e5fb17a9f2b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "content": "GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure.\n\nThe vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under", "creation_timestamp": "2026-09-12T01:00:40.745139Z"}, {"uuid": "c14727ac-7854-42f8-80f8-c50b1ec85379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mvc4htwcxn2t", "content": "\u26a0\ufe0f PATCH NOW\n\nGitLab shipped a critical patch: CVE-2026-85706 lets an unauthenticated attacker read files, including secrets, off a self-managed GitLab server (CVSS 10). Scanning for exposed servers has already begun.\n\nSelf-managed GitLab is exposed.\n\nPatch to 19.3.2, 19.2.6, or 19.1.8 now.", "creation_timestamp": "2026-09-12T03:15:08.597861Z"}, {"uuid": "f443b541-cd9a-47fd-9655-38e463a0fc79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvc4iinftb2j", "content": "GitLab CVE-2026-85706 (CVSS 10.0) unauthenticated path traversal allows arbitrary file read \u2014 patch to 19.1.8, 19.2.6 or 19.3.2 now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-12T03:15:29.837543Z"}, {"uuid": "6fb6034b-3bf6-439f-a557-18b4575fbf27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvc6gglmzz2n", "content": "CVE-2026-85706 - community edition and enterprise edition\nA flaw in GitLab\u2019s repository commits API could let someone without an account view files stored on the server. The issue affected all GitLab Community and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitlab #CVE #infosec", "creation_timestamp": "2026-09-12T03:50:07.792278Z"}, {"uuid": "cd605333-7d1c-4b0c-8a08-82f53097d923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3k7hyp62jl6su", "content": "CVE-2026-85706 - GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability - [Actively Exploited]\nCVE ID : CVE-2026-85706\n \n Published : Sept. 12, 2026, 3:16 a.m. | 19\u00a0minutes ago\n \n Description : GitLab has remediated an issue in GitLab CE/EE affecting all ...", "creation_timestamp": "2026-09-12T05:05:02.175357Z"}, {"uuid": "a865ced0-5e5e-4f6d-a23c-20eba0b52574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvc6zdaq7u2k", "content": "\ud83d\udd34 CVE-2026-85706 - Critical (10)\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-85706/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T04:00:42.779203Z"}, {"uuid": "aa635077-503f-4a5b-a37f-1fe1cf17ac44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mvc74w4ajr2g", "content": "~Cisa~\nCISA added actively exploited GitLab CE/EE path traversal CVE-2026-85706 to its KEV Catalog.\n-\nIOCs: CVE-2026-85706\n-\n#CVE-2026-85706 #GitLab #ThreatIntel", "creation_timestamp": "2026-09-12T04:02:42.899588Z"}, {"uuid": "ac66dcf1-ee59-4c34-a83e-a120f9736cd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mvccfsh2e522", "content": "GitLab CVSS 10\u306e\u8a8d\u8a3c\u306a\u3057\u30d5\u30a1\u30a4\u30eb\u8aad\u53d6\u8106\u5f31\u6027\u3001\u91ce\u751f\u306e\u63a2\u7d22\u6d3b\u52d5\u3092\u89b3\u6e2c\n\nGitLab\u304c CVE-2026-85706 (CVSS 10.0) \u306e\u30d1\u30b9\u30c8\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3002\u8a8d\u8a3c\u306a\u3057\u3067\u4efb\u610f\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u53d6\u53ef\u80fd\u306a\u81f4\u547d\u7684\u306a\u6b20\u9665\u3067\u3001\u65e2\u306b\u653b\u6483\u8005\u306b\u3088\u308b\u63a2\u7d22\u6d3b\u52d5\u304c\u78ba\u8a8d\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u9069\u7528\u304c\u5fc5\u9808\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-09-12T05:01:22.246682Z"}, {"uuid": "b9f773e6-e71f-435a-a4de-b6092e37fa41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcdaj4frr2z", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 1\u2026\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T05:16:17.765317Z"}, {"uuid": "6dafb914-f581-4d09-8f27-93867a81af62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mvcdpfmmae27", "content": "CISA\u304c\u8b66\u544a\u3001GitLab\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u304c\u653b\u6483\u306b\u60aa\u7528\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81(CISA)\u306f\u3001GitLab\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027(CVE-2026-85706)\u304c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u3001\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027(KEV)\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002Cybersecuritythreat intelligence \u3053\u306e\u554f\u984c\u306fGitLab Commun...", "creation_timestamp": "2026-09-12T05:24:37.732901Z"}, {"uuid": "e6fcfd5e-c6d8-438f-a31d-e07544bd4d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvcdpfwdxm2q", "content": "\ud83e\udd16 CVE-2026-85706 (CVSS 10.0): path traversal in GitLab's commits API \u2014 unauthenticated file read. Patches out; in-the-wild probes within hours of disclosure.\nhttps://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html", "creation_timestamp": "2026-09-12T05:24:38.391608Z"}, {"uuid": "4678ecea-74a4-466a-8c8e-ccb70748a30e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mvcfogk4sd2f", "content": "\ud83d\udd34 GitLab : path traversal s\u00e9v\u00e9rit\u00e9 max (CVE-2026-85706).\nhttps://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1160/\n\n\u2b06\ufe0f Microsoft : Patch Tuesday record, ~974 failles corrig\u00e9es, 2 zero-days exploit\u00e9s.\nhttps://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/", "creation_timestamp": "2026-09-12T05:59:52.663221Z"}, {"uuid": "dd193112-ceab-4461-817a-aa42d5eac7e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcgx7nuks2q", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 1\u2026\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T06:22:40.747319Z"}, {"uuid": "34087006-5c3c-4f27-b340-122d737e6135", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mvch5kxmqv2n", "content": "Top 3 CVE for last 7 days:\nCVE-2026-85046: 42 interactions\nCVE-2026-85880: 22 interactions\nCVE-2026-44756: 19 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-85706: 10 interactions\nCVE-2026-72898: 9 interactions\nCVE-2026-20349: 8 interactions\n", "creation_timestamp": "2026-09-12T06:26:14.444963Z"}, {"uuid": "4996dc6c-3fbe-49b9-9516-79437f61e4b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcknf6qzr2c", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 1\u2026\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T07:28:46.894105Z"}, {"uuid": "06b3e8a6-1741-4fb1-92a6-2b9589bf91f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mvcltx754k2g", "content": "GitLab CVE-2026-85706: Active Scanning Targeting Pre-Authentication File Read dev.to/anoymask/git...", "creation_timestamp": "2026-09-12T07:50:21.558938Z"}, {"uuid": "91420863-caed-4225-b77d-d78a79367cf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://gist.github.com/ichintu/b2551ef3f508cdf69182327288db5ab0", "content": "A critical, actively exploited vulnerability (CVE-2026-85706, CVSS 10.0) affects GitLab CE/EE versions 18.7\u201319.1.7, 19.2\u201319.2.5, and 19.3\u201319.3.1. It allows unauthenticated attackers to read arbitrary files due to improper path confinement and missing authentication in the repository commits API. The issue was disclosed on September 12, 2026.", "creation_timestamp": "2026-09-12T08:02:37.834616Z"}, {"uuid": "486cf063-6e47-421b-8885-7d1bf71c0ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvcxevkm4v22", "content": "If you run GitLab, CVE-2026-85706 path traversal is being actively exploited \u2014 check exposed instances and apply vendor updates when available. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-12T11:16:40.110248Z"}, {"uuid": "013ce0e2-bc55-4547-b902-7b6cfe97894b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/117257195519994657", "content": "PoC for unauthenticated arbitrary file read on Gitlab https://github.com/guneykabel/cve-2026-85706", "creation_timestamp": "2026-09-12T08:46:52.901900Z"}, {"uuid": "82e1f373-c947-4a43-a4d7-c7eaf7fb790a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mvcoz6ictb52", "content": "PoC for unauthenticated arbitrary file read on Gitlab https://github.com/guneykabel/cve-2026-85706", "creation_timestamp": "2026-09-12T08:47:04.530738Z"}, {"uuid": "f44ec9dd-7b66-4318-b21a-2bd8a30af534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://gist.github.com/mqu/be4e4fcd858d1bd7c6b15f87d6d6921a", "content": "", "creation_timestamp": "2026-09-12T08:47:25.341433Z"}, {"uuid": "4b423c28-0b3e-41d8-8863-a6ebb1c1caf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/proxy_bar/3625", "content": "CVE-2026-85706   GitLab CE/EE\n*\nVersion:  18.7\u201319.1.7, 19.2.0\u201319.2.5, 19.3.0\u201319.3.1\n*\nexploit", "creation_timestamp": "2026-09-12T09:00:04.559189Z"}, {"uuid": "5c41b737-67b0-4723-9aee-bb2e7493226c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/calmnewzvibez.bsky.social/post/3mvcvwb3a4c2w", "content": "GitLab Critical Path Traversal: Analyzing the Impact of CVE-2026-85706\n\nA deep dive into the critical CVE-2026-85706 GitLab vulnerability, its active exploitation by attackers, and essential remediation steps for self-managed instan\n\n#CISA #GitLab\n\nRead more \u2192", "creation_timestamp": "2026-09-12T10:50:43.115003Z"}, {"uuid": "bbbfd7e2-7139-4874-aa5f-3c05bf9b2df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0367", "content": "GitLab heeft een kwetsbaarheid verholpen in GitLab Community en Enterprise Editions. De kwetsbaarheid bevindt zich in de repository commits API, waarbij een path traversal mogelijk is. Hierdoor kunnen niet-geauthenticeerde gebruikers willekeurige bestanden op het systeem lezen. De oorzaak ligt in onjuiste path confinement gecombineerd met ontbrekende authenticatiecontroles in de API-endpoint.\n\nCISA heeft CVE-2026-85706 opgenomen in de Known Exploited Vulnerabilities-catalogus en er is publieke exploitcode beschikbaar. Vooral internetbereikbare, zelfbeheerde GitLab-installaties lopen risico, omdat een aanvaller zonder inloggegevens gevoelige bestanden kan lezen. Werk kwetsbare systemen direct bij naar GitLab 19.1.8, 19.2.6, 19.3.2 of nieuwer en onderzoek de API-logs op verdachte verzoeken met parameters als file.path. Roteer mogelijk blootgestelde credentials wanneer aanwijzingen voor misbruik worden aangetroffen.\n\nControleer bijgevoegde referenties voor de laatste updates.", "creation_timestamp": "2026-09-12T10:00:41.651863Z"}, {"uuid": "d641b58f-23b3-4e24-aa72-8b7e892f516c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvd43umo2d2i", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T12:41:05.704997Z"}, {"uuid": "49e11f5b-ed20-424b-8c55-a0d5966db83b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvd5lgirja23", "content": "Self-hosted GitLab CVE-2026-85706 critical unauthenticated path traversal is being exploited in the wild \u2014 apply vendor updates now. https://cti.securitycyber.uk", "creation_timestamp": "2026-09-12T13:07:55.045291Z"}, {"uuid": "664430bb-626d-4e81-bdae-3c28ca31e3ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mvd7bnrv7f2f", "content": "CVE-2026-85706 is trending. Hype score 9, currently #4 on cvemon.\n\nGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-85706", "creation_timestamp": "2026-09-12T13:38:01.302735Z"}, {"uuid": "094e8ddc-6034-473a-8e91-71493f1bf26f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvd7sd6rwf2c", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-85706: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab\nCVSS 10 \u00b7 CISA KEV \u00b7 0day\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T13:47:20.476957Z"}, {"uuid": "8e1a32ca-4555-40bb-b4a5-571e033720ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mvdauitsbg2g", "content": "GitLab CVE-2026-85706: CVSS 10.0 pre-auth file read, with a three-day patch window. If GitLab holds your CI secrets or ICS build pipelines, assume exposure and rotate. #ThreatIntel #ICS #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-85706-preauth-file-read-2026", "creation_timestamp": "2026-09-12T14:06:29.058344Z"}, {"uuid": "227dcda9-de76-41c6-93d4-ad2c1049a6dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvdaukcaqe2e", "content": "GitLab CVE-2026-85706: CVSS 10.0 pre-auth file read, with a three-day patch window. If GitLab holds your CI secrets or ICS build pipelines, assume exposure and rotate. #ThreatIntel #ICS #PotatoSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitlab-cve-2026-85706-preauth-file-read-2026", "creation_timestamp": "2026-09-12T14:06:29.913801Z"}, {"uuid": "cd6d5288-74ae-4b09-b5a2-073a31095799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mvdgtsnolc2d", "content": "GitLab urges users to patch max severity path traversal flaw\n\nGitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. [...]\n#hackernews #news", "creation_timestamp": "2026-09-12T15:53:28.355521Z"}, {"uuid": "7e511f15-dda3-4f62-9258-9375aff7305f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/rxerium.com/post/3mvdj7xs3ez26", "content": "\ud83d\udea8 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:\ngithub.com/projectdisco...", "creation_timestamp": "2026-09-12T16:36:03.072106Z"}, {"uuid": "c0c60b4d-a52d-42d2-a7aa-7380e050b27c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvdka4n5qp2c", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-85706: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19\u2026\nCVSS 10 \u00b7 exploited\nhttps://beta.vulnsea.com/cve/CVE-2026-85706\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T16:54:01.303010Z"}, {"uuid": "01ff6a1b-a179-4fae-b74c-59133048f728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-85706", "type": "seen", "source": "https://bsky.app/profile/endoflife.ai/post/3mvdmvedudl24", "content": "\ud83d\udcd6 New from endoflife.ai:\n\nGitLab CVE-2026-85706: Six Lines Without a Fix, 19.1 Ends September 17\n\nhttps://endoflife.ai/article-gitlab-cve-2026-85706-six-lines-without-a-fix", "creation_timestamp": "2026-09-12T17:41:41.240382Z"}, {"uuid": "62dd5bd2-9045-4fa7-8353-e3e81e07bc0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117259307061577312", "content": "\ud83d\udcf0 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability\nGitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\ud83d\udd17 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "creation_timestamp": "2026-09-12T17:43:53.824613Z"}, {"uuid": "1a9402e0-995e-42fc-a2bb-4b8a2dd048bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mvdn2cf4y72u", "content": "GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-09-12T17:44:26.845770Z"}, {"uuid": "42d6a10a-1578-4294-a4b3-0147c298f72e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85706", "type": "seen", "source": "https://t.me/HackingTeamGrupoOfficial/49066", "content": "\u26a0\ufe0f CVE-2026-85706 - GitLab CE/EE Unauthenticated arbitrary file read\nCVSS 10.0\nVulnerabilidad cr\u00edtica de GitLab en la funcionalidad de la API de commits. Un usuario no autorizado puede leer archivos arbitrarios del servidor a trav\u00e9s de path traversal.\nEl problema radica en que la API no restringe las rutas y no requiere autenticaci\u00f3n. Basta con un solo proyecto p\u00fablico en la instancia.\nVersiones vulnerables: 18.7 \u2192 19.1.7 inclusive 19.2.0 \u2192 19.2.5 inclusive 19.3.0 \u2192 19.3.1 inclusive\nCorregido en: 19.1.8 / 19.2.6 / 19.3.2 (parche del 10 de septiembre)\nComprobaci\u00f3n r\u00e1pida: curl -sk -X POST\n\"https://TARGET/api/v4/projects/1/repository/%63ommits?file=&file.path=/var/opt/gitlab/gitlab-rails/etc/gitlab.yml&file.size=1&Content-Type=application/x-www-form-urlencoded\"\nSi el host es vulnerable - en la respuesta habr\u00e1 un fragmento del contenido del archivo dentro del error invalid %-encoding.\nPoC ya est\u00e1 en acceso p\u00fablico: \ud83d\ude0a\n\u27a1\ufe0f https://github.com/guneykabel/cve-2026-85706 \u27a1\ufe0f https://github.com/mhtsec/CVE-2026-85706", "creation_timestamp": "2026-09-12T18:00:05.285485Z"}]}