Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-61560
  • github.com/zereight/gitlab-mcp
 @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover 15 Sep
  • Fix available
  • Severity - 9.8 (Critical)
CVE-2026-61559
  • github.com/zereight/gitlab-mcp
 @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery 15 Sep
  • Fix available
  • Severity - 9.6 (Critical)
CVE-2026-61568
  • github.com/zereight/gitlab-mcp
 @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport 15 Sep
  • Fix available
  • Severity - 9.6 (Critical)
CVE-2026-61462
  • github.com/zereight/gitlab-mcp
 mcp-gitlab Path Traversal via job_id Parameter 13 Jul
  • Fix available
  • Severity - 9.2 (Critical)