Do Son GitLab AI Gateway vulnerability CVE-2026-90970 (CVSS 9.9) lets Duo Agent Platform users run commands. Upgrade self-hosted gateways now.
Template Injection
A FOSSBilling template injection flaw (CVE-2026-28496, CVSS 9.4) is exploited in the wild. Patch to 0.8.0 now to stop server-side template injection.
GitLab patches critical flaw CVE-2026-1868 (CVSS 9.9) in self-hosted AI Gateway. Vulnerability allows RCE via insecure templates. Update to v18.8.1 now.
A Critical (CVSS 9.1) flaw (CVE-2025-37729) in Elastic Cloud Enterprise allows authenticated Admin RCE. Attackers exploit Jinjava template injection to exfiltrate data and execute commands.
CVE-2025-1087: Critical flaw in Kong Insomnia allows template injection and arbitrary code execution. Users urged to update to v11.0.2 immediately.