NVD や CVE、ほか複数の脅威フィードを束ね、RCE など高リスクな事象を深く追える一覧です。CVSS と EPSS を組み合わせ、Exploit 参照や PoC の有無から悪用しやすさを追跡します。ベンダー修正や緩和策の文脈とあわせて優先度を決め、対応サイクルを短く保ちつつ重要資産を守る支援をします。
Assigner（CNA／発行元）：[email protected] この条件を外す
| CVE | 説明 | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|
| CVE-2026-11827 | GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentials due to improper authorization controls. | 4.9 | 0.26% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15169 | UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 5.5 | 0.22% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15167 | DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 7.5 | 0.16% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15166 | IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 5.5 | 0.14% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15163 | Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service | 5.5 | 0.19% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15170 | Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 5.5 | 0.14% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15171 | SSH protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 5.5 | 0.10% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15172 | FMP/NOTIFY protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 5.5 | 0.11% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15173 | pcapng file parser crash in Wireshark 4.6.0 to 4.6.6 allows denial of service | 4.7 | 0.10% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15174 | Catapult DCT2000 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service | 5.5 | 0.10% | 2026-07-08 | 2026-07-09 |
| CVE-2026-15168 | BLF file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows possible information disclosure | 2.5 | 0.11% | 2026-07-08 | 2026-07-09 |
| CVE-2026-11950 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 該当なし | 該当なし | 2026-07-01 | 2026-07-01 |
| CVE-2026-1606 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation. | 4.3 | 0.22% | 2026-06-25 | 2026-06-26 |
| CVE-2026-2238 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to improper authorization checks. | 5.3 | 0.27% | 2026-06-25 | 2026-06-26 |
| CVE-2026-5796 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the Package Registry disabled due to incorrect authorization checks in the group packages feature. | 4.3 | 0.19% | 2026-06-25 | 2026-06-26 |
| CVE-2026-5952 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules and overwrite protected Maven package metadata due to incorrect authorization checks. | 4.3 | 0.21% | 2026-06-25 | 2026-06-26 |
| CVE-2026-0934 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations despite CI/CD visibility being disabled for the project. | 3.8 | 0.20% | 2026-06-25 | 2026-06-26 |
| CVE-2026-10086 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input. | 8.7 | 0.23% | 2026-06-25 | 2026-06-26 |
| CVE-2026-11379 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile secrets under certain conditions. | 5.3 | 0.19% | 2026-06-25 | 2026-06-26 |
| CVE-2026-12053 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows. | 8.6 | 0.33% | 2026-06-25 | 2026-06-26 |