GraphQL

GitLab Issues Critical Security Updates Fixing Unauthenticated Project Modification Flaws

GitLab has released security updates for its Community Edition and Enterprise Edition platforms to address two vulnerabilities, including one rated critical. The flaws were reported through the company's bug bounty program and affect multiple supported versions. CVE-2026-19478 is a code injection issue that allows remote attackers to tamper with or delete public projects and user data via GraphQL directives without authentication under certain conditions. CVE-2026-19650 is a CSRF vulnerability stemming from insufficient validation in GraphQL multiplexed query handling, enabling mutation execution through GET requests. Both CVEs received high CVSS scores, prompting GitLab to urge immediate upgrades to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11.

From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline

INFERA AI.SafeCode integrates seven distinct security scanners into one continuous analysis platform that automatically validates findings instead of flooding teams with unconfirmed alerts. The solution combines SAST, SCA, Secrets detection, DAST, AI-driven Pentest agents, Code Fuzzing, and API Fuzzing to deliver proof-of-exploit evidence for high-risk issues. By cross-validating results across engines, the platform reduces false positives and provides developers with actionable tasks that include reproduction steps, stack traces, and one-click AutoFix recommendations directly inside IDEs and Git workflows. Special attention is given to AI-generated code from tools such as GitHub Copilot, Cursor, and Claude, ensuring that rapid development does not introduce unvetted vulnerabilities. The system also maps full attack surfaces, tracks reachability from entry points to vulnerable sinks, and supports compliance requirements including FSTEC orders for critical information infrastructure. MLSecOps capabilities extend coverage to machine-learning pipelines, model configurations, and inference APIs. Overall, INFERA shifts AppSec from reactive alert triage to measurable risk management with clear MTTR metrics and SLA tracking.