{"generated_at":"2026-10-23T15:36:35.720Z","count":3,"incidents":[{"id":"gitlab-community-edition-and-enterprise-edition-path-tra-cve-2026-85706","url":"https://pwned.coffee/i/gitlab-community-edition-and-enterprise-edition-path-tra-cve-2026-85706","title":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","summary":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. Added to CISA KEV on 2026-09-11 (federal deadline 2026-09-14).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"GitLab Community Edition and Enterprise Edition","fixed_versions":[],"ids":["CVE-2026-85706"],"stack":["gitlab"],"first_seen":"2026-09-11T12:00:00.000Z","updated_at":"2026-09-11T12:00:00.000Z"},{"id":"gitlab-server-side-request-forgery-ssrf-vulnerability-cve-2021-22175","url":"https://pwned.coffee/i/gitlab-server-side-request-forgery-ssrf-vulnerability-cve-2021-22175","title":"GitLab Server-Side Request Forgery (SSRF) Vulnerability","summary":"GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled. Added to CISA KEV on 2026-02-18 (federal deadline 2026-03-11).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"GitLab GitLab","fixed_versions":[],"ids":["CVE-2021-22175"],"stack":["gitlab"],"first_seen":"2026-02-18T12:00:00.000Z","updated_at":"2026-02-18T12:00:00.000Z"},{"id":"gitlab-community-and-enterprise-editions-server-side-req-cve-2021-39935","url":"https://pwned.coffee/i/gitlab-community-and-enterprise-editions-server-side-req-cve-2021-39935","title":"GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability","summary":"GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API. Added to CISA KEV on 2026-02-03 (federal deadline 2026-02-24).","severity":"high","patch_status":"patched","status":"past","exploited":true,"affected":"GitLab Community and Enterprise Editions","fixed_versions":[],"ids":["CVE-2021-39935"],"stack":["gitlab"],"first_seen":"2026-02-03T12:00:00.000Z","updated_at":"2026-02-03T12:00:00.000Z"}]}