Open Source Vulnerabilities

Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260

Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261

Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

Commerce Stripe - Moderately critical - Improper verification of cryptographic signature - SA-CONTRIB-2026-264

Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267

AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268

AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270

AI (Artificial Intelligence) - Less critical - Information Disclosure - SA-CONTRIB-2026-271

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281

Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280

OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286

OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Content Sync (content-sync.io) - Moderately critical - Information disclosure - SA-CONTRIB-2026-291

Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292

rsyslog-mmfields, rsyslog-mmfields

gitlab-rails-ce-19.4

gitlab-rails-ce-19.4

gitlab-rails-ce-19.4

gitlab-rails-ce-19.4

velero, velero

velero, velero

commercial-gitlab-workhorse-ee-19.3

commercial-gitlab-workhorse-ee-19.3

commercial-gitlab-workhorse-ee-19.3

commercial-gitlab-workhorse-ee-19.3

gitlab-rails-ce-fips-19.5

gitlab-rails-ce-fips-19.5

gitlab-rails-ce-fips-19.5

druid, druid

druid, druid

step, step

step, step

step, step

step, step

linux-microvm-6.18

kibana-9.5

rsyslog-relp, rsyslog-relp

wazuh-dashboard

gitlab-rails-ce-19.4