Tag

#cve

Tagged “cve”

6 articles

GitLab's critical patch: unauth file read from the commits API

GitLab 19.3.2, 19.2.6 and 19.1.8 ship eighteen CVEs' worth of fixes, including a Critical unauthenticated arbitrary-file read on the repository commits API. Self-managed operators have a downtime problem stacked on top of a rotate-your-CI-variables problem.

Sep 11, 2026 · Tomás Vega Supply chain security

The command your agent approved is not the command that ran

A Docker write-up walks through CVE-2026-22708, a Cursor flaw where shell built-ins slipped past the agent's allowlist and quietly rewrote the environment, turning an approved git branch into arbitrary code execution. Docker's answer is to sandbox the whole agent, which shrinks the blast radius without closing every hole.

Aug 18, 2026 · Tomás Vega Security & supply chain

GitLab's mid-month patch train fixes a CI/CD pipeline authorization bypass

GitLab shipped 19.2.2, 19.1.4 and 19.0.6 with 13 CVEs, including an authorization bypass that let developer-role users run CI pipelines against protected branches. Self-managed operators should upgrade immediately.

Aug 13, 2026 · Maya Okonkwo Supply-chain security

Aikido buys Root to patch open source in place, without the upgrade dance

Aikido Security acquired Root, a company whose technology fixes known vulnerabilities directly inside the package version you already run. The trade-off: someone other than upstream now decides what your dependency looks like on disk.

Jul 1, 2026 · Tomás Vega Security & supply chain

Chainguard's drop-in Java libraries trade a framework upgrade for an SLA

Chainguard is shipping drop-in remediated Java libraries for legacy shops carrying unpatched CVE backlogs, positioned as a package swap inside the build in place of a framework upgrade. The trade-off is who owns the patching SLA from then on.

Jun 25, 2026 · Tomás Vega Security & supply chain

Docker Engine 29.4.3 moves the 'Copy Fail' mitigation off seccomp after the first fix broke 32-bit containers

Docker's default profile now uses AppArmor and SELinux to block the AF_ALG socket path that CVE-2026-31431 exploits, after a seccomp-only fix in 29.4.2 broke i386 binaries, Go 386 builds and Wine. The kernel patch is still the real fix; on Ubuntu it has not landed yet.

Jun 16, 2026 · Maya Okonkwo