Vulnerability intelligence

CVE-2026-93577 is an integer overflow vulnerability found in the regular expression compiler of GitLab CE/EE. This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is compiled within a CI/CD configuration. Affected versions include all GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-89078 is identified as a double free vulnerability affecting the regular expression parser in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is parsed within a CI/CD configuration. GitLab has released remediations for this issue, impacting versions 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-84502 is a vulnerability identified in the automation-controller component of Red Hat Ansible Automation Platform. The flaw stems from insufficient validation of the `Project scm_url` field. This field, when not properly sanitized, is passed directly to the `git SCM` module. Specifically, the `git ls-remote` command, which is executed by the module, does not use a "--" separator. This oversight allows a malicious Git project URL, crafted to begin with a dash (e.g., "--upload-pack=<command>:x"), to be interpreted as a `git` option. Consequently, an authenticated user with permissions to create or modify a project within a single organization can execute arbitrary commands on the control-plane task pod, with the output visible through the project update stdout endpoint. This can lead to cross-tenant compromise and lateral movement within the cluster.

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CVE-2026-67279 describes a vulnerability in MikroTik RouterOS SSH where the system improperly handles a client-requested rekey operation. This flaw allows the SSH server to proceed to the connection protocol stage and accept session channel requests, even though user authentication has not been completed. As a result, an unauthenticated client can open an SSH session channel and issue `exec` requests. This capability permits the creation, overwriting, and reconstruction of files within the RouterOS managed file namespace, including critical configuration and diagnostic data.

CVE-2026-65660 is a vulnerability affecting Microsoft Office SharePoint, specifically SharePoint Server 2016, 2019, and Subscription Edition, with potential impact on SharePoint 2013. This flaw stems from an improper control of code generation, characterized as a 'code injection' vulnerability. It involves a parser desynchronization issue within SharePoint's `SafeControls` filter, which is designed to prevent the loading of dangerous classes. The vulnerability arises when the `ToolPane` component processes web-part markup, failing to properly escape quotes within attribute values when reconstructing `Register` directives. This oversight allows an attacker to inject additional directives through unescaped quotes, enabling the registration of arbitrary .NET classes. While initially described by Microsoft as a spoofing vulnerability, further technical analysis revealed that CVE-2026-65660 can lead to authenticated remote code execution (RCE). Researchers have also demonstrated that this flaw can be chained with other vulnerabilities to achieve pre-authentication remote code execution on servers configured to allow anonymous page access.