CVE-2026-19478

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

August 18, 2026

Last Seen

September 12, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Active Exploitation of GitLab CVE-2026-19478 and Microsoft Entra ID Flaw84.0

GitLab's CVE-2026-19478, a critical code injection vulnerability with a CVSS score of 9.4, is currently under active exploitation just days after its public disclosure on August 17, 2026. Attackers are leveraging this flaw to execute unauthorized code, posing a significant risk to organizations usin...

Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure81.0

On September 10, 2026, GitLab released patches for critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706, a path traversal flaw, allows unauthenticated users to read arbitrary files from GitLab servers, while CVE-2026-87719 enables credential theft via insecure deserialization....

Critical GitLab Vulnerability Allows Unauthenticated Data Deletion72.3

GitLab released an emergency patch on August 17, 2026, for a critical vulnerability tracked as CVE-2026-19478. This flaw allows unauthenticated attackers to remotely modify or delete public projects and user data through a GraphQL directive, with a CVSS score of 9.4. Affected versions include GitLab...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (3)

Related Entities

Data Breach Zero-day Exploit Supply Chain Attack Malware Phishing InjectEave Attack Cursor Microolap CVE-2026-19650 CVE-2026-85706 CVE-2026-87719 CVE-2025-25249

CVE-2026-19478

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Public Exploits

CVE Details

Related Clusters (3)

Active Exploitation of GitLab CVE-2026-19478 and Microsoft Entra ID Flaw

Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure

Critical GitLab Vulnerability Allows Unauthenticated Data Deletion

Related Articles (18)

One HTTP Request, Every File on the Server: GitLab's CVSS 10 Commits

Max severity GitLab path traversal flaw under active reconnaissance | news

GitLab CVSS 10 File-Read Flaw Draws In-the

GitLab Vulnerability Exploited One Day After Disclosure

[SecurityIntel] 22 Aug | GitLab CVE-2026-19478 Under Active Exploitation

Critical GitLab Flaw Lets Hackers Alter or Delete Public Projects

GitLab ships out-of-band fix for CVSS 9.4 GraphQL bug

Critical GitLab Zero

Critical GitLab flaw allows attackers to delete and modify public repos

GitLab Ships Emergency Patch for Critical CVSS 9.4 GraphQL Flaw That Lets ...

Critical security vulnerability in GitLab: Attackers can delete projects

GitLab issues emergency patch for critical code

GitLab Emergency Patch: Third GraphQL Flaw of 2026 Lets Unauthenticated Attackers ...

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

GitLab - the flaw that forced them to reopen a dead branch

GitLab Patches Critical Unauthenticated GraphQL Vulnerability

CVE-2026-19478: Critical GitLab CE/EE GraphQL Vulnerability Enables Remote Deletion of ...

Critical GitLab GraphQL Vulnerability Allow Attackers to Delete Public Projects

Related Entities