CISA warns hackers are exploiting this max severity GitLab flaw

A 10/10 GitLab flaw was added to CISA's KEV, giving government agencies just three days to patch.
The Hacker News

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched CVE-2026-85706, a CVSS 10 path traversal flaw enabling unauthenticated file reads, as in-the-wild probes began.

GitLab urges users to patch max severity path traversal flaw

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability ...
SecurityWeek

GitLab Vulnerability Exploited One Day After Disclosure

Threat actors started exploiting CVE-2026-85706, a critical-severity path traversal in GitLab, one day after public ...
Forkast News

One HTTP Request, Every File on the Server: GitLab’s CVSS 10 Commits-API Flaw Hits Active Exploitation Within Hours

A single HTTP POST to the commits API bypasses all security controls and reads arbitrary files from a GitLab server. CISA ...
MSSP Alert

GitLab users urged to patch critical path traversal vulnerability

GitLab users are being strongly advised to apply patches for a critical-severity vulnerability, identified as CVE-2026-85706, ...
CSOonline

LangChain path traversal bug adds to input validation woes in AI pipelines

The path traversal flaw, allowing access to arbitrary files, adds to a growing set of input validation issues in AI pipelines. Security researchers are warning that applications using AI frameworks ...