CVE-2026-16553

MediumCVSS 5.4/10Last modified Aug 3, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in virtual registries.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2026
Last modified
Aug 3, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-165547.8cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters CVE-2026-165574.3The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through aCVE-2026-165585.4The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoinCVE-2026-165596.8The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits theirCVE-2026-16565.3The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up toCVE-2026-165605.3A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close thCVE-2026-165617.5The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenCVE-2026-165626.5The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relyiCVE-2026-165636.5The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson CVE-2026-165644.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST CVE-2026-165654.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its pCVE-2026-165675.3The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the fi
CVE-2026-16553: Medium severity, CVSS 5.4 | Vulnix