CVE Daily – GitLab (High+Critical) https://cvedaily.com/pages/tags/gitlab.html CVE Daily – GitLab (High+Critical) en Wed, 03 Jun 2026 21:26:40 +0000 [High] CVE-2026-4868 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-4868 https://nvd.nist.gov/vuln/detail/CVE-2026-4868 Wed, 27 May 2026 19:16:24 +0000 High CVE-2026-4868

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could have allowed an authenticated user to cause specific Duo AI workflows to run under another user's identity due to improper user identity resolution when triggering Duo AI workflow runners.

CVSS: 8.2 · CWE: CWE-639

View on NVD

]]> [Critical] CVE-2026-44895 – GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the ... https://nvd.nist.gov/vuln/detail/CVE-2026-44895 https://nvd.nist.gov/vuln/detail/CVE-2026-44895 Tue, 26 May 2026 22:16:42 +0000 Critical CVE-2026-44895

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator's GITLAB_PERSONAL_ACCESS_TOKEN without any inboun…

CVSS: 9.2 · CWE: CWE-306

View on NVD

]]> [High] CVE-2026-3515 – A vulnerability in the `GitHubRepository` block of the `prefect-github` integrat... https://nvd.nist.gov/vuln/detail/CVE-2026-3515 https://nvd.nist.gov/vuln/detail/CVE-2026-3515 Sun, 24 May 2026 05:16:39 +0000 High CVE-2026-3515

A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git clone` command string without proper sanitization, and then parsed by `shlex.split()`. This enables injection of options such as `-c`, lead…

CVSS: 8.5 · CWE: CWE-88

View on NVD

]]> [High] CVE-2026-7481 – GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-7481 https://nvd.nist.gov/vuln/detail/CVE-2026-7481 Thu, 14 May 2026 06:16:25 +0000 High CVE-2026-7481

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-7377 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-7377 https://nvd.nist.gov/vuln/detail/CVE-2026-7377 Thu, 14 May 2026 06:16:25 +0000 High CVE-2026-7377

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-6073 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-6073 https://nvd.nist.gov/vuln/detail/CVE-2026-6073 Thu, 14 May 2026 06:16:24 +0000 High CVE-2026-6073

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-1659 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1659 https://nvd.nist.gov/vuln/detail/CVE-2026-1659 Thu, 14 May 2026 06:16:21 +0000 High CVE-2026-1659

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-14870 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14870 https://nvd.nist.gov/vuln/detail/CVE-2025-14870 Thu, 14 May 2026 06:16:20 +0000 High CVE-2025-14870

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-14869 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14869 https://nvd.nist.gov/vuln/detail/CVE-2025-14869 Thu, 14 May 2026 06:16:20 +0000 High CVE-2025-14869

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2026-5816 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10... https://nvd.nist.gov/vuln/detail/CVE-2026-5816 https://nvd.nist.gov/vuln/detail/CVE-2026-5816 Wed, 22 Apr 2026 17:16:44 +0000 High CVE-2026-5816

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.

CVSS: 8.0 · CWE: CWE-41

View on NVD

]]> [High] CVE-2026-5262 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1... https://nvd.nist.gov/vuln/detail/CVE-2026-5262 https://nvd.nist.gov/vuln/detail/CVE-2026-5262 Wed, 22 Apr 2026 17:16:44 +0000 High CVE-2026-5262

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.

CVSS: 8.0 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-4922 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 ... https://nvd.nist.gov/vuln/detail/CVE-2026-4922 https://nvd.nist.gov/vuln/detail/CVE-2026-4922 Wed, 22 Apr 2026 17:16:44 +0000 High CVE-2026-4922

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

CVSS: 8.1 · CWE: CWE-352

View on NVD

]]> [High] CVE-2026-40161 – Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style ... https://nvd.nist.gov/vuln/detail/CVE-2026-40161 https://nvd.nist.gov/vuln/detail/CVE-2026-40161 Tue, 21 Apr 2026 17:16:53 +0000 High CVE-2026-40161

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can e…

CVSS: 7.7 · CWE: CWE-201

View on NVD

]]> [High] CVE-2026-5173 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9... https://nvd.nist.gov/vuln/detail/CVE-2026-5173 https://nvd.nist.gov/vuln/detail/CVE-2026-5173 Wed, 08 Apr 2026 23:17:00 +0000 High CVE-2026-5173

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

CVSS: 8.5 · CWE: CWE-749

View on NVD

]]> [High] CVE-2026-1092 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10... https://nvd.nist.gov/vuln/detail/CVE-2026-1092 https://nvd.nist.gov/vuln/detail/CVE-2026-1092 Wed, 08 Apr 2026 23:16:57 +0000 High CVE-2026-1092

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2025-12664 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 ... https://nvd.nist.gov/vuln/detail/CVE-2025-12664 https://nvd.nist.gov/vuln/detail/CVE-2025-12664 Wed, 08 Apr 2026 23:16:56 +0000 High CVE-2025-12664

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2026-2370 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 ... https://nvd.nist.gov/vuln/detail/CVE-2026-2370 https://nvd.nist.gov/vuln/detail/CVE-2026-2370 Mon, 30 Mar 2026 00:16:01 +0000 High CVE-2026-2370

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

CVSS: 8.1 · CWE: CWE-233

View on NVD

]]> [High] CVE-2026-3988 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3988 https://nvd.nist.gov/vuln/detail/CVE-2026-3988 Wed, 25 Mar 2026 17:17:09 +0000 High CVE-2026-3988

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

CVSS: 7.5 · CWE: CWE-407

View on NVD

]]> [High] CVE-2026-3857 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10... https://nvd.nist.gov/vuln/detail/CVE-2026-3857 https://nvd.nist.gov/vuln/detail/CVE-2026-3857 Wed, 25 Mar 2026 17:17:09 +0000 High CVE-2026-3857

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

CVSS: 8.1 · CWE: CWE-352

View on NVD

]]> [High] CVE-2026-2995 – GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-2995 https://nvd.nist.gov/vuln/detail/CVE-2026-2995 Wed, 25 Mar 2026 17:16:58 +0000 High CVE-2026-2995

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

CVSS: 7.7 · CWE: CWE-80

View on NVD

]]> [High] CVE-2026-1090 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1090 https://nvd.nist.gov/vuln/detail/CVE-2026-1090 Wed, 11 Mar 2026 16:16:22 +0000 High CVE-2026-1090

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-1069 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1069 https://nvd.nist.gov/vuln/detail/CVE-2026-1069 Wed, 11 Mar 2026 16:16:22 +0000 High CVE-2026-1069

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances.

CVSS: 7.5 · CWE: CWE-674

View on NVD

]]> [High] CVE-2025-14513 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11... https://nvd.nist.gov/vuln/detail/CVE-2025-14513 https://nvd.nist.gov/vuln/detail/CVE-2025-14513 Wed, 11 Mar 2026 16:16:19 +0000 High CVE-2025-14513

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2025-13929 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13929 https://nvd.nist.gov/vuln/detail/CVE-2025-13929 Wed, 11 Mar 2026 16:16:19 +0000 High CVE-2025-13929

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2026-1662 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1662 https://nvd.nist.gov/vuln/detail/CVE-2026-1662 Wed, 25 Feb 2026 21:16:36 +0000 High CVE-2026-1662

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2026-1388 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1388 https://nvd.nist.gov/vuln/detail/CVE-2026-1388 Wed, 25 Feb 2026 21:16:36 +0000 High CVE-2026-1388

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

CVSS: 7.5 · CWE: CWE-1333

View on NVD

]]> [High] CVE-2026-0752 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 ... https://nvd.nist.gov/vuln/detail/CVE-2026-0752 https://nvd.nist.gov/vuln/detail/CVE-2026-0752 Wed, 25 Feb 2026 21:16:36 +0000 High CVE-2026-0752

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

CVSS: 8.0 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-14511 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14511 https://nvd.nist.gov/vuln/detail/CVE-2025-14511 Wed, 25 Feb 2026 21:16:30 +0000 High CVE-2025-14511

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2026-0958 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 ... https://nvd.nist.gov/vuln/detail/CVE-2026-0958 https://nvd.nist.gov/vuln/detail/CVE-2026-0958 Wed, 11 Feb 2026 12:16:03 +0000 High CVE-2026-0958

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.

CVSS: 7.5 · CWE: CWE-436

View on NVD

]]> [High] CVE-2026-0595 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-0595 https://nvd.nist.gov/vuln/detail/CVE-2026-0595 Wed, 11 Feb 2026 12:16:03 +0000 High CVE-2026-0595

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML injection in test case titles.

CVSS: 7.3 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-8099 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 ... https://nvd.nist.gov/vuln/detail/CVE-2025-8099 https://nvd.nist.gov/vuln/detail/CVE-2025-8099 Wed, 11 Feb 2026 12:16:03 +0000 High CVE-2025-8099

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-7659 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 ... https://nvd.nist.gov/vuln/detail/CVE-2025-7659 https://nvd.nist.gov/vuln/detail/CVE-2025-7659 Wed, 11 Feb 2026 12:16:03 +0000 High CVE-2025-7659

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE.

CVSS: 8.0 · CWE: CWE-346

View on NVD

]]> [High] CVE-2025-14560 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14560 https://nvd.nist.gov/vuln/detail/CVE-2025-14560 Wed, 11 Feb 2026 12:16:02 +0000 High CVE-2025-14560

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious content into vulnerability code flow.

CVSS: 7.3 · CWE: CWE-79

View on NVD

]]> [Critical] CVE-2026-1868 – GitLab has remediated a vulnerability in the Duo Workflow Service component of G... https://nvd.nist.gov/vuln/detail/CVE-2026-1868 https://nvd.nist.gov/vuln/detail/CVE-2026-1868 Mon, 09 Feb 2026 07:16:18 +0000 Critical CVE-2026-1868

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted Duo Agent Platform Flow definitions. This vulnerability could be used to cause Denial of Service or gai…

CVSS: 9.9 · CWE: CWE-1336

View on NVD

]]> [High] CVE-2026-0723 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-0723 https://nvd.nist.gov/vuln/detail/CVE-2026-0723 Thu, 22 Jan 2026 15:16:50 +0000 High CVE-2026-0723

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

CVSS: 7.4 · CWE: CWE-252

View on NVD

]]> [High] CVE-2025-13928 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13928 https://nvd.nist.gov/vuln/detail/CVE-2025-13928 Thu, 22 Jan 2026 15:16:47 +0000 High CVE-2025-13928

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

CVSS: 7.5 · CWE: CWE-863

View on NVD

]]> [High] CVE-2025-13927 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13927 https://nvd.nist.gov/vuln/detail/CVE-2025-13927 Thu, 22 Jan 2026 15:16:47 +0000 High CVE-2025-13927

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-11224 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10... https://nvd.nist.gov/vuln/detail/CVE-2025-11224 https://nvd.nist.gov/vuln/detail/CVE-2025-11224 Wed, 14 Jan 2026 19:16:40 +0000 High CVE-2025-11224

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

CVSS: 7.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-0830 – Processing specially crafted workspace folder names could allow for arbitrary co... https://nvd.nist.gov/vuln/detail/CVE-2026-0830 https://nvd.nist.gov/vuln/detail/CVE-2026-0830 Fri, 09 Jan 2026 21:16:14 +0000 High CVE-2026-0830

Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

CVSS: 7.8 · CWE: CWE-78

View on NVD

]]> [High] CVE-2025-9222 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2... https://nvd.nist.gov/vuln/detail/CVE-2025-9222 https://nvd.nist.gov/vuln/detail/CVE-2025-9222 Fri, 09 Jan 2026 10:15:47 +0000 High CVE-2025-9222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to achieve stored cross-site scripting by exploiting GitLab Flavored Markdown.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-13772 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 bef... https://nvd.nist.gov/vuln/detail/CVE-2025-13772 https://nvd.nist.gov/vuln/detail/CVE-2025-13772 Fri, 09 Jan 2026 10:15:45 +0000 High CVE-2025-13772

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorized namespaces by manipulating namespace identifiers in API requests.

CVSS: 7.1 · CWE: CWE-862

View on NVD

]]> [High] CVE-2025-13761 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13761 https://nvd.nist.gov/vuln/detail/CVE-2025-13761 Fri, 09 Jan 2026 10:15:45 +0000 High CVE-2025-13761

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.

CVSS: 8.0 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-61916 – Spinnaker is an open source, multi-cloud continuous delivery platform. Versions ... https://nvd.nist.gov/vuln/detail/CVE-2025-61916 https://nvd.nist.gov/vuln/detail/CVE-2025-61916 Mon, 05 Jan 2026 22:15:50 +0000 High CVE-2025-61916

Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into spinnaker pipelines via helm or other methods to extract things LIKE idmsv1 authentication data. This also includes calling…

CVSS: 7.9 · CWE: CWE-20

View on NVD

]]> [High] CVE-2025-12029 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11... https://nvd.nist.gov/vuln/detail/CVE-2025-12029 https://nvd.nist.gov/vuln/detail/CVE-2025-12029 Thu, 11 Dec 2025 08:15:47 +0000 High CVE-2025-12029

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."

CVSS: 8.0 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-8405 – GitLab has remediated a security issue in GitLab CE/EE affecting all versions fr... https://nvd.nist.gov/vuln/detail/CVE-2025-8405 https://nvd.nist.gov/vuln/detail/CVE-2025-8405 Thu, 11 Dec 2025 05:16:38 +0000 High CVE-2025-8405

GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.

CVSS: 7.7 · CWE: CWE-116

View on NVD

]]> [High] CVE-2025-12716 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 ... https://nvd.nist.gov/vuln/detail/CVE-2025-12716 https://nvd.nist.gov/vuln/detail/CVE-2025-12716 Thu, 11 Dec 2025 04:15:58 +0000 High CVE-2025-12716

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-12562 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10... https://nvd.nist.gov/vuln/detail/CVE-2025-12562 https://nvd.nist.gov/vuln/detail/CVE-2025-12562 Thu, 11 Dec 2025 04:15:58 +0000 High CVE-2025-12562

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2024-9183 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 ... https://nvd.nist.gov/vuln/detail/CVE-2024-9183 https://nvd.nist.gov/vuln/detail/CVE-2024-9183 Fri, 05 Dec 2025 17:16:01 +0000 High CVE-2024-9183

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific conditions.

CVSS: 7.7 · CWE: CWE-367

View on NVD

]]> [High] CVE-2025-12571 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10... https://nvd.nist.gov/vuln/detail/CVE-2025-12571 https://nvd.nist.gov/vuln/detail/CVE-2025-12571 Wed, 26 Nov 2025 20:15:47 +0000 High CVE-2025-12571

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-11702 – GitLab has remediated an issue in EE affecting all versions from 17.1 before 18... https://nvd.nist.gov/vuln/detail/CVE-2025-11702 https://nvd.nist.gov/vuln/detail/CVE-2025-11702 Wed, 29 Oct 2025 07:15:37 +0000 High CVE-2025-11702

GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

CVSS: 8.5 · CWE: CWE-862

View on NVD

]]> [High] CVE-2025-11447 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 ... https://nvd.nist.gov/vuln/detail/CVE-2025-11447 https://nvd.nist.gov/vuln/detail/CVE-2025-11447 Mon, 27 Oct 2025 00:15:40 +0000 High CVE-2025-11447

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-10497 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10... https://nvd.nist.gov/vuln/detail/CVE-2025-10497 https://nvd.nist.gov/vuln/detail/CVE-2025-10497 Mon, 27 Oct 2025 00:15:39 +0000 High CVE-2025-10497

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-11340 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to ... https://nvd.nist.gov/vuln/detail/CVE-2025-11340 https://nvd.nist.gov/vuln/detail/CVE-2025-11340 Thu, 09 Oct 2025 12:15:35 +0000 High CVE-2025-11340

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.

CVSS: 7.7 · CWE: CWE-863

View on NVD

]]> [High] CVE-2025-10004 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12... https://nvd.nist.gov/vuln/detail/CVE-2025-10004 https://nvd.nist.gov/vuln/detail/CVE-2025-10004 Thu, 09 Oct 2025 12:15:34 +0000 High CVE-2025-10004

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2021-4460 – In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd:... https://nvd.nist.gov/vuln/detail/CVE-2021-4460 https://nvd.nist.gov/vuln/detail/CVE-2021-4460 Wed, 01 Oct 2025 12:15:31 +0000 High CVE-2021-4460

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a shift operation where the number of bits shifted equals number of bits in the operand. This behaviour is undefined. Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the count is >= number of…

CVSS: 7.1 · CWE: CWE-125

View on NVD

]]> [High] CVE-2025-8014 – Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versi... https://nvd.nist.gov/vuln/detail/CVE-2025-8014 https://nvd.nist.gov/vuln/detail/CVE-2025-8014 Sat, 27 Sep 2025 17:15:33 +0000 High CVE-2025-8014

Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-9958 – An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 b... https://nvd.nist.gov/vuln/detail/CVE-2025-9958 https://nvd.nist.gov/vuln/detail/CVE-2025-9958 Fri, 26 Sep 2025 09:15:49 +0000 High CVE-2025-9958

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

CVSS: 7.7 · CWE: CWE-201

View on NVD

]]> [High] CVE-2025-9642 – An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 b... https://nvd.nist.gov/vuln/detail/CVE-2025-9642 https://nvd.nist.gov/vuln/detail/CVE-2025-9642 Fri, 26 Sep 2025 09:15:49 +0000 High CVE-2025-9642

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-10858 – An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18... https://nvd.nist.gov/vuln/detail/CVE-2025-10858 https://nvd.nist.gov/vuln/detail/CVE-2025-10858 Fri, 26 Sep 2025 09:15:30 +0000 High CVE-2025-10858

An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-6454 – An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 b... https://nvd.nist.gov/vuln/detail/CVE-2025-6454 https://nvd.nist.gov/vuln/detail/CVE-2025-6454 Fri, 12 Sep 2025 06:15:42 +0000 High CVE-2025-6454

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

CVSS: 8.5 · CWE: CWE-918

View on NVD

]]> [High] CVE-2025-2256 – An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 be... https://nvd.nist.gov/vuln/detail/CVE-2025-2256 https://nvd.nist.gov/vuln/detail/CVE-2025-2256 Fri, 12 Sep 2025 06:15:42 +0000 High CVE-2025-2256

An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2025-7739 – An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 be... https://nvd.nist.gov/vuln/detail/CVE-2025-7739 https://nvd.nist.gov/vuln/detail/CVE-2025-7739 Wed, 13 Aug 2025 18:15:32 +0000 High CVE-2025-7739

An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-7734 – An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 be... https://nvd.nist.gov/vuln/detail/CVE-2025-7734 https://nvd.nist.gov/vuln/detail/CVE-2025-7734 Wed, 13 Aug 2025 18:15:32 +0000 High CVE-2025-7734

An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-6186 – An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 be... https://nvd.nist.gov/vuln/detail/CVE-2025-6186 https://nvd.nist.gov/vuln/detail/CVE-2025-6186 Wed, 13 Aug 2025 18:15:32 +0000 High CVE-2025-6186

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-8279 – Insufficient input validation within GitLab Language Server 7.6.0 and later befo... https://nvd.nist.gov/vuln/detail/CVE-2025-8279 https://nvd.nist.gov/vuln/detail/CVE-2025-8279 Mon, 28 Jul 2025 14:15:28 +0000 High CVE-2025-8279

Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution

CVSS: 8.7 · CWE: CWE-306

View on NVD

]]> [High] CVE-2025-4700 – An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 b... https://nvd.nist.gov/vuln/detail/CVE-2025-4700 https://nvd.nist.gov/vuln/detail/CVE-2025-4700 Wed, 23 Jul 2025 18:15:27 +0000 High CVE-2025-4700

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-4439 – An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 b... https://nvd.nist.gov/vuln/detail/CVE-2025-4439 https://nvd.nist.gov/vuln/detail/CVE-2025-4439 Wed, 23 Jul 2025 18:15:27 +0000 High CVE-2025-4439

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks.

CVSS: 7.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-6948 – An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 b... https://nvd.nist.gov/vuln/detail/CVE-2025-6948 https://nvd.nist.gov/vuln/detail/CVE-2025-6948 Thu, 10 Jul 2025 09:15:30 +0000 High CVE-2025-6948

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2024-4994 – An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 ... https://nvd.nist.gov/vuln/detail/CVE-2024-4994 https://nvd.nist.gov/vuln/detail/CVE-2024-4994 Fri, 20 Jun 2025 19:15:35 +0000 High CVE-2024-4994

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

CVSS: 8.1 · CWE: CWE-352

View on NVD

]]> [High] CVE-2025-5121 – An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 b... https://nvd.nist.gov/vuln/detail/CVE-2025-5121 https://nvd.nist.gov/vuln/detail/CVE-2025-5121 Fri, 20 Jun 2025 18:15:28 +0000 High CVE-2025-5121

An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2. A missing authorization check may have allowed compliance frameworks to be applied to projects outside the compliance framework's group.

CVSS: 8.5 · CWE: CWE-862

View on NVD

]]> [High] CVE-2025-2443 – An issue has been discovered in GitLab EE that allows for cross-site-scripting a... https://nvd.nist.gov/vuln/detail/CVE-2025-2443 https://nvd.nist.gov/vuln/detail/CVE-2025-2443 Fri, 20 Jun 2025 18:15:28 +0000 High CVE-2025-2443

An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2022-50084 – In the Linux kernel, the following vulnerability has been resolved: dm raid: fi... https://nvd.nist.gov/vuln/detail/CVE-2022-50084 https://nvd.nist.gov/vuln/detail/CVE-2022-50084 Wed, 18 Jun 2025 11:15:37 +0000 High CVE-2022-50084

In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid ================================================================== BUG: KASAN: slab-out-of-bound…

CVSS: 7.1 · CWE: CWE-125

View on NVD

]]> [High] CVE-2025-0673 – An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 be... https://nvd.nist.gov/vuln/detail/CVE-2025-0673 https://nvd.nist.gov/vuln/detail/CVE-2025-0673 Thu, 12 Jun 2025 11:15:18 +0000 High CVE-2025-0673

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition.

CVSS: 7.5 · CWE: CWE-835

View on NVD

]]> [High] CVE-2025-4278 – An issue has been discovered in GitLab CE/EE affecting all versions starting wit... https://nvd.nist.gov/vuln/detail/CVE-2025-4278 https://nvd.nist.gov/vuln/detail/CVE-2025-4278 Thu, 12 Jun 2025 10:16:39 +0000 High CVE-2025-4278

An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.

CVSS: 8.7 · CWE: CWE-80

View on NVD

]]> [High] CVE-2025-2254 – An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 be... https://nvd.nist.gov/vuln/detail/CVE-2025-2254 https://nvd.nist.gov/vuln/detail/CVE-2025-2254 Thu, 12 Jun 2025 10:16:38 +0000 High CVE-2025-2254

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-1763 – An issue has been discovered in GitLab EE that allows for cross-site-scripting a... https://nvd.nist.gov/vuln/detail/CVE-2025-1763 https://nvd.nist.gov/vuln/detail/CVE-2025-1763 Fri, 30 May 2025 11:15:20 +0000 High CVE-2025-1763

An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-0993 – An issue has been discovered in GitLab CE/EE affecting all versions before 17.10... https://nvd.nist.gov/vuln/detail/CVE-2025-0993 https://nvd.nist.gov/vuln/detail/CVE-2025-0993 Thu, 22 May 2025 15:16:04 +0000 High CVE-2025-0993

An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. This could allow an authenticated attacker to cause a denial of service condition by exhausting server resources.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-1908 – An issue has been discovered in GitLab EE/CE that could allow an attacker to tra... https://nvd.nist.gov/vuln/detail/CVE-2025-1908 https://nvd.nist.gov/vuln/detail/CVE-2025-1908 Thu, 24 Apr 2025 08:15:14 +0000 High CVE-2025-1908

An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

CVSS: 7.7 · CWE: CWE-840

View on NVD

]]> [High] CVE-2025-2255 – An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions f... https://nvd.nist.gov/vuln/detail/CVE-2025-2255 https://nvd.nist.gov/vuln/detail/CVE-2025-2255 Thu, 27 Mar 2025 13:15:36 +0000 High CVE-2025-2255

An issue has been discovered in Gitlab EE/CE for AppSec affecting all versions from 13.5.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Certain error messages could allow Cross-Site Scripting attacks (XSS). for AppSec.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-2242 – An improper access control vulnerability in GitLab CE/EE affecting all versions ... https://nvd.nist.gov/vuln/detail/CVE-2025-2242 https://nvd.nist.gov/vuln/detail/CVE-2025-2242 Thu, 27 Mar 2025 13:15:36 +0000 High CVE-2025-2242

An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to groups and projects.

CVSS: 7.5 · CWE: CWE-863

View on NVD

]]> [High] CVE-2025-0811 – An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 be... https://nvd.nist.gov/vuln/detail/CVE-2025-0811 https://nvd.nist.gov/vuln/detail/CVE-2025-0811 Thu, 27 Mar 2025 13:15:36 +0000 High CVE-2025-0811

An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. Improper rendering of certain file types leads to cross-site scripting.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-0555 – A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions f... https://nvd.nist.gov/vuln/detail/CVE-2025-0555 https://nvd.nist.gov/vuln/detail/CVE-2025-0555 Mon, 03 Mar 2025 16:15:39 +0000 High CVE-2025-0555

A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under specific conditions.

CVSS: 7.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-0475 – An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 p... https://nvd.nist.gov/vuln/detail/CVE-2025-0475 https://nvd.nist.gov/vuln/detail/CVE-2025-0475 Mon, 03 Mar 2025 11:15:15 +0000 High CVE-2025-0475

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [Critical] CVE-2024-7102 – An issue was discovered in GitLab CE/EE affecting all versions starting from 16... https://nvd.nist.gov/vuln/detail/CVE-2024-7102 https://nvd.nist.gov/vuln/detail/CVE-2024-7102 Thu, 13 Feb 2025 01:15:24 +0000 Critical CVE-2024-7102

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.

CVSS: 9.6 · CWE: CWE-250

View on NVD

]]> [High] CVE-2025-0376 – An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 pri... https://nvd.nist.gov/vuln/detail/CVE-2025-0376 https://nvd.nist.gov/vuln/detail/CVE-2025-0376 Wed, 12 Feb 2025 15:15:15 +0000 High CVE-2025-0376

An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2024-10383 – An issue has been discovered in the gitlab-web-ide-vscode-fork component distrib... https://nvd.nist.gov/vuln/detail/CVE-2024-10383 https://nvd.nist.gov/vuln/detail/CVE-2024-10383 Fri, 07 Feb 2025 15:15:16 +0000 High CVE-2024-10383

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2024-2878 – An issue has been discovered in GitLab CE/EE affecting all versions starting fro... https://nvd.nist.gov/vuln/detail/CVE-2024-2878 https://nvd.nist.gov/vuln/detail/CVE-2024-2878 Wed, 05 Feb 2025 13:15:22 +0000 High CVE-2024-2878

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2024-9631 – An issue was discovered in GitLab CE/EE affecting all versions starting from 13... https://nvd.nist.gov/vuln/detail/CVE-2024-9631 https://nvd.nist.gov/vuln/detail/CVE-2024-9631 Wed, 05 Feb 2025 11:15:17 +0000 High CVE-2024-9631

An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.

CVSS: 7.5 · CWE: CWE-407

View on NVD

]]> [High] CVE-2025-0314 – An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 be... https://nvd.nist.gov/vuln/detail/CVE-2025-0314 https://nvd.nist.gov/vuln/detail/CVE-2025-0314 Fri, 24 Jan 2025 03:15:07 +0000 High CVE-2025-0314

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site scripting.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2024-8233 – An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 bef... https://nvd.nist.gov/vuln/detail/CVE-2024-8233 https://nvd.nist.gov/vuln/detail/CVE-2024-8233 Thu, 12 Dec 2024 12:15:28 +0000 High CVE-2024-8233

An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could cause a denial of service with requests for diff files on a commit or merge request.

CVSS: 7.5 · CWE: CWE-407

View on NVD

]]> [High] CVE-2024-11274 – An issue was discovered in GitLab CE/EE affecting all versions starting from 16... https://nvd.nist.gov/vuln/detail/CVE-2024-11274 https://nvd.nist.gov/vuln/detail/CVE-2024-11274 Thu, 12 Dec 2024 12:15:22 +0000 High CVE-2024-11274

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.

CVSS: 8.7 · CWE: CWE-601

View on NVD

]]> [High] CVE-2024-8114 – An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 be... https://nvd.nist.gov/vuln/detail/CVE-2024-8114 https://nvd.nist.gov/vuln/detail/CVE-2024-8114 Tue, 26 Nov 2024 19:15:31 +0000 High CVE-2024-8114

An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.

CVSS: 8.2 · CWE: CWE-862

View on NVD

]]> [High] CVE-2024-9693 – An issue was discovered in GitLab CE/EE affecting all versions starting from 16... https://nvd.nist.gov/vuln/detail/CVE-2024-9693 https://nvd.nist.gov/vuln/detail/CVE-2024-9693 Thu, 14 Nov 2024 11:15:05 +0000 High CVE-2024-9693

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.

CVSS: 8.5 · CWE: CWE-863

View on NVD

]]> [High] CVE-2024-8312 – An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 b... https://nvd.nist.gov/vuln/detail/CVE-2024-8312 https://nvd.nist.gov/vuln/detail/CVE-2024-8312 Thu, 24 Oct 2024 10:15:03 +0000 High CVE-2024-8312

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. An attacker could inject HTML into the Global Search field on a diff view leading to XSS.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [Critical] CVE-2024-9164 – An issue was discovered in GitLab EE affecting all versions starting from 12.5 p... https://nvd.nist.gov/vuln/detail/CVE-2024-9164 https://nvd.nist.gov/vuln/detail/CVE-2024-9164 Fri, 11 Oct 2024 13:15:17 +0000 Critical CVE-2024-9164

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

CVSS: 9.6 · CWE: CWE-306

View on NVD

]]> [High] CVE-2024-8970 – An issue was discovered in GitLab CE/EE affecting all versions starting from 11... https://nvd.nist.gov/vuln/detail/CVE-2024-8970 https://nvd.nist.gov/vuln/detail/CVE-2024-8970 Fri, 11 Oct 2024 13:15:17 +0000 High CVE-2024-8970

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.

CVSS: 8.2 · CWE: CWE-863

View on NVD

]]> [High] CVE-2024-6530 – A cross-site scripting issue has been discovered in GitLab affecting all version... https://nvd.nist.gov/vuln/detail/CVE-2024-6530 https://nvd.nist.gov/vuln/detail/CVE-2024-6530 Thu, 10 Oct 2024 12:15:04 +0000 High CVE-2024-6530

A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances.

CVSS: 7.3 · CWE: CWE-79

View on NVD

]]> [High] CVE-2024-8977 – An issue has been discovered in GitLab EE affecting all versions starting from 1... https://nvd.nist.gov/vuln/detail/CVE-2024-8977 https://nvd.nist.gov/vuln/detail/CVE-2024-8977 Thu, 10 Oct 2024 10:15:08 +0000 High CVE-2024-8977

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

CVSS: 8.2 · CWE: CWE-918

View on NVD

]]> [High] CVE-2024-46683 – In the Linux kernel, the following vulnerability has been resolved: drm/xe: pre... https://nvd.nist.gov/vuln/detail/CVE-2024-46683 https://nvd.nist.gov/vuln/detail/CVE-2024-46683 Fri, 13 Sep 2024 06:15:12 +0000 High CVE-2024-46683

In the Linux kernel, the following vulnerability has been resolved: drm/xe: prevent UAF around preempt fence The fence lock is part of the queue, therefore in the current design anything locking the fence should then also hold a ref to the queue to prevent the queue from being freed. However, currently it looks like we signal the fence and then drop the queue ref, but if something is waiting o…

CVSS: 7.8 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2024-6678 – An issue was discovered in GitLab CE/EE affecting all versions starting from 8.1... https://nvd.nist.gov/vuln/detail/CVE-2024-6678 https://nvd.nist.gov/vuln/detail/CVE-2024-6678 Thu, 12 Sep 2024 19:15:04 +0000 Critical CVE-2024-6678

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.

CVSS: 9.9 · CWE: CWE-290

View on NVD

]]>