Vulnerability intelligence

CVE-2026-93577 is an integer overflow vulnerability found in the regular expression compiler of GitLab CE/EE. This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is compiled within a CI/CD configuration. Affected versions include all GitLab CE/EE versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-89078 is identified as a double free vulnerability affecting the regular expression parser in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw could enable an authenticated user to execute arbitrary code on the GitLab server. The vulnerability is triggered when a specially crafted regular expression is parsed within a CI/CD configuration. GitLab has released remediations for this issue, impacting versions 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

CVE-2026-87899 is a vulnerability found in the CalDAV and CardDAV service of cPanel & WHM. This flaw allows an authenticated user with a cPanel hosting account to execute arbitrary code with root privileges. Exploitation of this vulnerability can lead to an attacker gaining full control of the server. cPanel has released fixed versions to address this issue, specifically cPanel & WHM versions 11.134.0.57 or later, 11.136.0.41 or later, and 11.138.0.8 or later.

CVE-2026-71362 is an Incorrect Authorization vulnerability identified in Adobe Commerce and Magento Open Source. This flaw allows for privilege escalation, meaning an attacker could gain elevated access to sensitive resources. Exploitation of this vulnerability does not require user interaction. Some reports indicate that this could enable an attacker to switch a customer's active account session to another, thereby gaining access to the victim's account and private data.

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.

CVE-2026-94127 is a heap-based buffer overflow vulnerability found in F5 BIG-IP Access Policy Manager (APM). This flaw specifically affects systems where an access policy and an OAuth profile are configured on a virtual server. The vulnerability allows an unauthenticated attacker to achieve remote code execution by sending specially crafted malicious traffic to the affected BIG-IP APM system. This issue has been observed to be actively exploited in the wild.