GitLab Issues Critical Security Updates Fixing Unauthenticated Project Modification Flaws
GitLab has released critical security updates for its development platform to address vulnerabilities that could allow unauthorized modification of public projects.
The company issued patches for GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) on August 17, 2026. The updates cover versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, resolving two issues reported via the bug bounty program.
The first vulnerability, tracked as CVE-2026-19478, is a code injection flaw with a CVSS v3.1 base score of 9.4. It enables remote attackers to modify or delete public projects and user data through GraphQL directives without requiring authentication under specific conditions.
The second issue, CVE-2026-19650, is a cross-site request forgery (CSRF) vulnerability rated 7.1 on CVSS v3.1. It arises from insufficient validation in GraphQL multiplexed query processing, allowing mutation operations to be executed via GET requests.
GitLab has classified the vulnerabilities as Critical and High severity respectively and strongly recommends that all users apply the updates immediately to mitigate potential risks.
Related articles
CISA Adds Ray AI Framework Flaw CVE-2025-62593 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning that a critical vulnerability in the Ray framework for scaling AI and Python applications is being actively exploited in real-world attacks. The flaw, tracked as CVE-2025-62593, allows remote code execution through browsers such as Firefox and Safari, potentially enabling attackers to run malicious code simply by displaying an ad on a compromised page. CISA added the issue to its Known Exploited Vulnerabilities catalog on August 17, 2026, and directed federal agencies to apply mitigations by August 20. Originally disclosed in November 2025 and fixed in Ray version 2.52.0, the vulnerability carries a CVSS v4.0 base score of 9.4 and is rated Critical. Developers using Ray in environments that also run Firefox or Safari face additional risk from DNS rebinding attacks that can lead to code injection. Organizations relying on Ray are urged to verify patch status and monitor for signs of compromise.
VoLTE Video Call Vulnerability Grants Kernel Access on Unisoc Android Chips
Researchers from SSD Secure Disclosure have disclosed a two-stage attack chain that achieves remote kernel access on Android devices powered by Unisoc chipsets. The exploit begins with a remote code execution flaw in the modem firmware that is triggered by a specially crafted VoLTE video call. Once code executes on the modem, a second privilege-escalation issue abuses shared physical memory between the modem and application processor to reach Android kernel memory. The attack requires an attacker-controlled 4G network and VoLTE infrastructure, and the victim must answer the incoming video call. Vulnerable chip families include T606, T612 and T7250, found in devices such as the Motorola E13, Realme C33 and Xiaomi Redmi A5. No patch or CVE identifier has been issued by Unisoc, and the August Android security bulletin does not address the issue.
SAP Commerce Cloud CVE-2026-58231 Critical Flaw Exploited in the Wild Just Three Days After Patch
SAP Commerce Cloud has been hit by a maximum-severity vulnerability tracked as CVE-2026-58231 that carries a CVSS score of 10.0. The flaw resides in the Data Hub Adapter component and allows unauthenticated remote code execution via a single crafted HTTP request. SAP released the official patch on 11 August, yet honeypots recorded the first exploitation attempts only three days later on 14 August. More than 4,200 internet-facing SAP Commerce Cloud instances have been identified worldwide, primarily in Europe and North America. Researchers note that AI-assisted patch analysis enabled attackers to weaponize the fix at unprecedented speed. Organizations are urged to apply the updates to versions 2211.55 or 2211-jdk21.17 immediately and restrict access to the affected endpoints in the meantime.
WordPress Login Page Exposed to Critical XSS2Shell Flaw CVE-2026-64638: Over 11,000 Sites Attacked Across 67 Countries
WordPress core login page vulnerability CVE-2026-64638 enables unauthenticated attackers to trigger reflected XSS that can escalate to full server compromise. The flaw stems from mismatched HTML sanitization between two filtering layers on the wp-login.php page, allowing malicious payloads to execute in the site origin. Imperva observed automated campaigns hitting more than 11,000 sites with hundreds of thousands of requests, predominantly affecting U.S. targets in gaming, education, and finance sectors. Successful exploitation chains the XSS into WordPress REST API and application password creation when an administrator is logged in, ultimately allowing malicious plugin uploads. Official patches are available in WordPress 7.0.3 and backported releases down to 4.7; administrators are urged to verify versions, audit user accounts, and inspect plugin directories immediately.