GitLab says CVE-2026-110264 (CVSS 10.0) could let an unauthenticated attacker run code on self-managed servers, in all versions since 7.0. It is GitLab's second CVSS 10.0 regex integer overflow in nine days: instances patched on Oct 12 (19.4.2, 19.3.5, 19.2.8) remain exposed until 19.5.1, 19.4.3, 19.3.6 or a 19.2.9 backport. GitLab lists no workaround and says GitLab.com and Dedicated were already patched. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ #GitLab #InfoSec #Cybersecurity #SelfHosted