CVE-2026-6976

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to hide changes from merge request diff views due to improper input handling of file names.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-697607.5Out-of-bounds read in Windows Kerberos allows an unauthorized attacker to deny service over a network.CVE-2026-697617.5Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network.CVE-2026-697628.8Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network.CVE-2026-697637.0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-697648.8Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.CVE-2026-697658.8Use after free in Windows Storport Miniport Driver allows an unauthorized attacker to execute code over a network.CVE-2026-697667.0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-697678.8Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.CVE-2026-697689.8Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network.CVE-2026-697699.8Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network.CVE-2026-69777.3A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component LegacCVE-2026-697705.5Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
CVE-2026-6976: Low severity, CVSS 3.7 | Vulnix