Veille CVE

Semaine du 5 octobre au 11 octobre 2026

4 CVE

Critique 1 Élevée 0 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « GitLab » ✕
  1. CVE-2026-1403 6.5 Moyenne

    GitLab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.

  2. CVE-2026-106463 5.4 Moyenne

    backstage · @backstage plugin-catalog-backend-module-gitlab · Linuxfoundation backstage\/plugin-catalog-backend-module-gitlab · Linuxfoundation backstage

    Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.

  3. CVE-2026-106462 6.4 Moyenne

    backstage · @backstage plugin-scaffolder-backend · @backstage plugin-scaffolder-backend-module-azure · @backstage plugin-scaffolder-backend-module-bitbucket-cloud

    Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

  4. CVE-2026-105640 9.1 Critique

    makeplane plane

    Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the address. An attacker can set an OAuth identity's unverified provider email to a victim's address, which Plane matches directly to the victim's existing local account. The attacker can then log in to the victim's Plane account without knowing the victim's password. GitHub, GitLab.com, and Google are not affected because those providers return verified email addresses. This issue is fixed in 1.4.0.