CVE Daily – GitLab https://cvedaily.com/pages/tags/gitlab.html CVE Daily – GitLab en Wed, 03 Jun 2026 21:26:40 +0000 [Low] CVE-2026-10078 – A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerab... https://nvd.nist.gov/vuln/detail/CVE-2026-10078 https://nvd.nist.gov/vuln/detail/CVE-2026-10078 Fri, 29 May 2026 11:16:16 +0000 Low CVE-2026-10078

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in various system logs, such as server access logs, reverse proxy…

CVSS: 2.7 · CWE: CWE-598

View on NVD

]]> [Medium] CVE-2026-9807 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-9807 https://nvd.nist.gov/vuln/detail/CVE-2026-9807 Thu, 28 May 2026 09:16:49 +0000 Medium CVE-2026-9807

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcement.

CVSS: 4.3 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-8716 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 ... https://nvd.nist.gov/vuln/detail/CVE-2026-8716 https://nvd.nist.gov/vuln/detail/CVE-2026-8716 Wed, 27 May 2026 19:16:25 +0000 Medium CVE-2026-8716

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to access CI data from a different ref type than intended.

CVSS: 4.3 · CWE: CWE-706

View on NVD

]]> [Medium] CVE-2026-6713 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 ... https://nvd.nist.gov/vuln/detail/CVE-2026-6713 https://nvd.nist.gov/vuln/detail/CVE-2026-6713 Wed, 27 May 2026 19:16:24 +0000 Medium CVE-2026-6713

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an unauthorized user to enumerate private projects due to incorrect authorization checks.

CVSS: 5.3 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-5296 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-5296 https://nvd.nist.gov/vuln/detail/CVE-2026-5296 Wed, 27 May 2026 19:16:24 +0000 Medium CVE-2026-5296

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that when foundational flows were enabled at the group level, could have allowed an authenticated user with developer-role permissions to bypass flow restrictions under certain conditions.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [High] CVE-2026-4868 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-4868 https://nvd.nist.gov/vuln/detail/CVE-2026-4868 Wed, 27 May 2026 19:16:24 +0000 High CVE-2026-4868

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could have allowed an authenticated user to cause specific Duo AI workflows to run under another user's identity due to improper user identity resolution when triggering Duo AI workflow runners.

CVSS: 8.2 · CWE: CWE-639

View on NVD

]]> [Medium] CVE-2026-2601 – GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-2601 https://nvd.nist.gov/vuln/detail/CVE-2026-2601 Wed, 27 May 2026 19:16:16 +0000 Medium CVE-2026-2601

GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitive deployment data on projects due to improper authorization checks.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-1402 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1402 https://nvd.nist.gov/vuln/detail/CVE-2026-1402 Wed, 27 May 2026 19:16:15 +0000 Medium CVE-2026-1402

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to cause denial of service due to insufficient validation.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Critical] CVE-2026-44895 – GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the ... https://nvd.nist.gov/vuln/detail/CVE-2026-44895 https://nvd.nist.gov/vuln/detail/CVE-2026-44895 Tue, 26 May 2026 22:16:42 +0000 Critical CVE-2026-44895

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator's GITLAB_PERSONAL_ACCESS_TOKEN without any inboun…

CVSS: 9.2 · CWE: CWE-306

View on NVD

]]> [High] CVE-2026-3515 – A vulnerability in the `GitHubRepository` block of the `prefect-github` integrat... https://nvd.nist.gov/vuln/detail/CVE-2026-3515 https://nvd.nist.gov/vuln/detail/CVE-2026-3515 Sun, 24 May 2026 05:16:39 +0000 High CVE-2026-3515

A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the `reference` field. The `reference` field is concatenated directly into a `git clone` command string without proper sanitization, and then parsed by `shlex.split()`. This enables injection of options such as `-c`, lead…

CVSS: 8.5 · CWE: CWE-88

View on NVD

]]> [Medium] CVE-2026-3117 – Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly che... https://nvd.nist.gov/vuln/detail/CVE-2026-3117 https://nvd.nist.gov/vuln/detail/CVE-2026-3117 Mon, 18 May 2026 09:16:22 +0000 Medium CVE-2026-3117

Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the {{gitlab instance {option}}} or the {{/gitlab webhook {option}}} commands. Mattermost Advisory ID: MMSA-2026-00600

CVSS: 6.5 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-8280 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 b... https://nvd.nist.gov/vuln/detail/CVE-2026-8280 https://nvd.nist.gov/vuln/detail/CVE-2026-8280 Thu, 14 May 2026 06:16:26 +0000 Medium CVE-2026-8280

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2026-8144 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 ... https://nvd.nist.gov/vuln/detail/CVE-2026-8144 https://nvd.nist.gov/vuln/detail/CVE-2026-8144 Thu, 14 May 2026 06:16:25 +0000 Medium CVE-2026-8144

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with project membership to enumerate private group members due to missing authorization checks.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [High] CVE-2026-7481 – GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-7481 https://nvd.nist.gov/vuln/detail/CVE-2026-7481 Thu, 14 May 2026 06:16:25 +0000 High CVE-2026-7481

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [Low] CVE-2026-7471 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-7471 https://nvd.nist.gov/vuln/detail/CVE-2026-7471 Thu, 14 May 2026 06:16:25 +0000 Low CVE-2026-7471

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with control of a virtual registry upstream to make requests to internal hosts due to improper validation.

CVSS: 3.5 · CWE: CWE-918

View on NVD

]]> [High] CVE-2026-7377 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-7377 https://nvd.nist.gov/vuln/detail/CVE-2026-7377 Thu, 14 May 2026 06:16:25 +0000 High CVE-2026-7377

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [Low] CVE-2026-6883 – GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-6883 https://nvd.nist.gov/vuln/detail/CVE-2026-6883 Thu, 14 May 2026 06:16:25 +0000 Low CVE-2026-6883

GitLab has remediated an issue in GitLab EE affecting all versions from 15.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to bypass merge request approval requirements due to improper cleanup of orphaned policy records.

CVSS: 2.6 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-6335 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11... https://nvd.nist.gov/vuln/detail/CVE-2026-6335 https://nvd.nist.gov/vuln/detail/CVE-2026-6335 Thu, 14 May 2026 06:16:24 +0000 Medium CVE-2026-6335

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user to execute arbitrary code in another user's browser session due to improper sanitization.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-6073 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-6073 https://nvd.nist.gov/vuln/detail/CVE-2026-6073 Thu, 14 May 2026 06:16:24 +0000 High CVE-2026-6073

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to execute arbitrary JavaScript in other users' browsers due to improper input sanitization.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2026-6063 – GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 be... https://nvd.nist.gov/vuln/detail/CVE-2026-6063 https://nvd.nist.gov/vuln/detail/CVE-2026-6063 Thu, 14 May 2026 06:16:24 +0000 Medium CVE-2026-6063

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that under certain conditions could have allowed an authenticated user with developer-role permissions to remove code owner approval rules from merge requests due to improper access control.

CVSS: 4.3 · CWE: CWE-639

View on NVD

]]> [Medium] CVE-2026-4527 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10... https://nvd.nist.gov/vuln/detail/CVE-2026-4527 https://nvd.nist.gov/vuln/detail/CVE-2026-4527 Thu, 14 May 2026 06:16:23 +0000 Medium CVE-2026-4527

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to create unauthorized Jira subscriptions for a targeted user's namespace via a specially crafted link due to missing CSRF protection.

CVSS: 6.5 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2026-4524 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9... https://nvd.nist.gov/vuln/detail/CVE-2026-4524 https://nvd.nist.gov/vuln/detail/CVE-2026-4524 Thu, 14 May 2026 06:16:23 +0000 Medium CVE-2026-4524

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

CVSS: 6.5 · CWE: CWE-288

View on NVD

]]> [Medium] CVE-2026-3607 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3607 https://nvd.nist.gov/vuln/detail/CVE-2026-3607 Thu, 14 May 2026 06:16:22 +0000 Medium CVE-2026-3607

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass package protection rules due to improper access control.

CVSS: 4.3 · CWE: CWE-1280

View on NVD

]]> [Medium] CVE-2026-3160 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3160 https://nvd.nist.gov/vuln/detail/CVE-2026-3160 Thu, 14 May 2026 06:16:22 +0000 Medium CVE-2026-3160

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to view Jira issues outside the configured project scope due to an integration filter functioning only as a display control rather than enforcing access boundaries as specified.

CVSS: 5.8 · CWE: CWE-441

View on NVD

]]> [Medium] CVE-2026-3074 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3074 https://nvd.nist.gov/vuln/detail/CVE-2026-3074 Thu, 14 May 2026 06:16:22 +0000 Medium CVE-2026-3074

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to download private debugging symbols from inaccessible projects due to improper access control.

CVSS: 4.3 · CWE: CWE-639

View on NVD

]]> [Medium] CVE-2026-3073 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3073 https://nvd.nist.gov/vuln/detail/CVE-2026-3073 Thu, 14 May 2026 06:16:22 +0000 Medium CVE-2026-3073

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to bypass PyPI package protection rules and upload restricted packages due to improper authorization checks.

CVSS: 4.3 · CWE: CWE-639

View on NVD

]]> [Low] CVE-2026-2900 – GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 be... https://nvd.nist.gov/vuln/detail/CVE-2026-2900 https://nvd.nist.gov/vuln/detail/CVE-2026-2900 Thu, 14 May 2026 06:16:21 +0000 Low CVE-2026-2900

GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.

CVSS: 2.7 · CWE: CWE-862

View on NVD

]]> [High] CVE-2026-1659 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1659 https://nvd.nist.gov/vuln/detail/CVE-2026-1659 Thu, 14 May 2026 06:16:21 +0000 High CVE-2026-1659

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2026-1338 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10... https://nvd.nist.gov/vuln/detail/CVE-2026-1338 https://nvd.nist.gov/vuln/detail/CVE-2026-1338 Thu, 14 May 2026 06:16:21 +0000 Medium CVE-2026-1338

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks.

CVSS: 4.3 · CWE: CWE-639

View on NVD

]]> [Medium] CVE-2026-1322 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1322 https://nvd.nist.gov/vuln/detail/CVE-2026-1322 Thu, 14 May 2026 06:16:21 +0000 Medium CVE-2026-1322

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

CVSS: 6.8 · CWE: CWE-840

View on NVD

]]> [Medium] CVE-2026-1184 – GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-1184 https://nvd.nist.gov/vuln/detail/CVE-2026-1184 Thu, 14 May 2026 06:16:21 +0000 Medium CVE-2026-1184

GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.

CVSS: 6.5 · CWE: CWE-502

View on NVD

]]> [High] CVE-2025-14870 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14870 https://nvd.nist.gov/vuln/detail/CVE-2025-14870 Thu, 14 May 2026 06:16:20 +0000 High CVE-2025-14870

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2025-14869 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14869 https://nvd.nist.gov/vuln/detail/CVE-2025-14869 Thu, 14 May 2026 06:16:20 +0000 High CVE-2025-14869

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [Medium] CVE-2025-13874 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13874 https://nvd.nist.gov/vuln/detail/CVE-2025-13874 Thu, 14 May 2026 06:16:20 +0000 Medium CVE-2025-13874

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with Guest permissions to view issues in projects they were not authorized to access.

CVSS: 4.3 · CWE: CWE-639

View on NVD

]]> [Medium] CVE-2025-12669 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11... https://nvd.nist.gov/vuln/detail/CVE-2025-12669 https://nvd.nist.gov/vuln/detail/CVE-2025-12669 Thu, 14 May 2026 06:16:19 +0000 Medium CVE-2025-12669

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to inject HTML and JavaScript into email notifications sent to other users due to improper input sanitization.

CVSS: 5.4 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2026-44931 – The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pw... https://nvd.nist.gov/vuln/detail/CVE-2026-44931 https://nvd.nist.gov/vuln/detail/CVE-2026-44931 Wed, 13 May 2026 13:01:55 +0000 Medium CVE-2026-44931

The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c in malcontent-timerd allows arbitrary users in the system to slowly fill up disk space in /var/lib/malcontent-timerd

CVSS: 5.1 · CWE: CWE-770

View on NVD

]]> [Low] CVE-2026-42195 – draw.io is a configurable diagramming and whiteboarding application. Prior to ve... https://nvd.nist.gov/vuln/detail/CVE-2026-42195 https://nvd.nist.gov/vuln/detail/CVE-2026-42195 Fri, 08 May 2026 22:16:31 +0000 Low CVE-2026-42195

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing a…

CVSS: 3.4 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2026-6515 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 ... https://nvd.nist.gov/vuln/detail/CVE-2026-6515 https://nvd.nist.gov/vuln/detail/CVE-2026-6515 Wed, 22 Apr 2026 17:16:44 +0000 Medium CVE-2026-6515

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.

CVSS: 5.4 · CWE: CWE-613

View on NVD

]]> [High] CVE-2026-5816 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10... https://nvd.nist.gov/vuln/detail/CVE-2026-5816 https://nvd.nist.gov/vuln/detail/CVE-2026-5816 Wed, 22 Apr 2026 17:16:44 +0000 High CVE-2026-5816

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.

CVSS: 8.0 · CWE: CWE-41

View on NVD

]]> [Medium] CVE-2026-5377 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11... https://nvd.nist.gov/vuln/detail/CVE-2026-5377 https://nvd.nist.gov/vuln/detail/CVE-2026-5377 Wed, 22 Apr 2026 17:16:44 +0000 Medium CVE-2026-5377

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process.

CVSS: 4.3 · CWE: CWE-863

View on NVD

]]> [High] CVE-2026-5262 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1... https://nvd.nist.gov/vuln/detail/CVE-2026-5262 https://nvd.nist.gov/vuln/detail/CVE-2026-5262 Wed, 22 Apr 2026 17:16:44 +0000 High CVE-2026-5262

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storybook development environment due to improper input validation.

CVSS: 8.0 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-4922 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 ... https://nvd.nist.gov/vuln/detail/CVE-2026-4922 https://nvd.nist.gov/vuln/detail/CVE-2026-4922 Wed, 22 Apr 2026 17:16:44 +0000 High CVE-2026-4922

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

CVSS: 8.1 · CWE: CWE-352

View on NVD

]]> [Low] CVE-2026-3254 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11... https://nvd.nist.gov/vuln/detail/CVE-2026-3254 https://nvd.nist.gov/vuln/detail/CVE-2026-3254 Wed, 22 Apr 2026 17:16:43 +0000 Low CVE-2026-3254

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox.

CVSS: 3.5 · CWE: CWE-1021

View on NVD

]]> [Medium] CVE-2026-1660 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1660 https://nvd.nist.gov/vuln/detail/CVE-2026-1660 Wed, 22 Apr 2026 17:16:33 +0000 Medium CVE-2026-1660

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Low] CVE-2025-9957 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 ... https://nvd.nist.gov/vuln/detail/CVE-2025-9957 https://nvd.nist.gov/vuln/detail/CVE-2025-9957 Wed, 22 Apr 2026 17:16:33 +0000 Low CVE-2025-9957

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.

CVSS: 2.7 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2025-6016 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 b... https://nvd.nist.gov/vuln/detail/CVE-2025-6016 https://nvd.nist.gov/vuln/detail/CVE-2025-6016 Wed, 22 Apr 2026 17:16:33 +0000 Medium CVE-2025-6016

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2025-3922 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 ... https://nvd.nist.gov/vuln/detail/CVE-2025-3922 https://nvd.nist.gov/vuln/detail/CVE-2025-3922 Wed, 22 Apr 2026 17:16:33 +0000 Medium CVE-2025-3922

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2025-0186 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 ... https://nvd.nist.gov/vuln/detail/CVE-2025-0186 https://nvd.nist.gov/vuln/detail/CVE-2025-0186 Wed, 22 Apr 2026 17:16:32 +0000 Medium CVE-2025-0186

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2026-40161 – Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style ... https://nvd.nist.gov/vuln/detail/CVE-2026-40161 https://nvd.nist.gov/vuln/detail/CVE-2026-40161 Tue, 21 Apr 2026 17:16:53 +0000 High CVE-2026-40161

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can e…

CVSS: 7.7 · CWE: CWE-201

View on NVD

]]> [High] CVE-2026-5173 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9... https://nvd.nist.gov/vuln/detail/CVE-2026-5173 https://nvd.nist.gov/vuln/detail/CVE-2026-5173 Wed, 08 Apr 2026 23:17:00 +0000 High CVE-2026-5173

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

CVSS: 8.5 · CWE: CWE-749

View on NVD

]]> [Low] CVE-2026-4916 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 ... https://nvd.nist.gov/vuln/detail/CVE-2026-4916 https://nvd.nist.gov/vuln/detail/CVE-2026-4916 Wed, 08 Apr 2026 23:17:00 +0000 Low CVE-2026-4916

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization checks on member management operations.

CVSS: 2.7 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-4332 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-4332 https://nvd.nist.gov/vuln/detail/CVE-2026-4332 Wed, 08 Apr 2026 23:16:59 +0000 Medium CVE-2026-4332

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2026-2619 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-2619 https://nvd.nist.gov/vuln/detail/CVE-2026-2619 Wed, 08 Apr 2026 23:16:58 +0000 Medium CVE-2026-2619

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.

CVSS: 4.3 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-2104 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 ... https://nvd.nist.gov/vuln/detail/CVE-2026-2104 https://nvd.nist.gov/vuln/detail/CVE-2026-2104 Wed, 08 Apr 2026 23:16:58 +0000 Medium CVE-2026-2104

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks.

CVSS: 4.3 · CWE: CWE-639

View on NVD

]]> [Medium] CVE-2026-1752 – GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-1752 https://nvd.nist.gov/vuln/detail/CVE-2026-1752 Wed, 08 Apr 2026 23:16:58 +0000 Medium CVE-2026-1752

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the API.

CVSS: 4.3 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-1516 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1516 https://nvd.nist.gov/vuln/detail/CVE-2026-1516 Wed, 08 Apr 2026 23:16:57 +0000 Medium CVE-2026-1516

GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.

CVSS: 5.7 · CWE: CWE-94

View on NVD

]]> [Medium] CVE-2026-1101 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-1101 https://nvd.nist.gov/vuln/detail/CVE-2026-1101 Wed, 08 Apr 2026 23:16:57 +0000 Medium CVE-2026-1101

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.

CVSS: 6.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2026-1092 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10... https://nvd.nist.gov/vuln/detail/CVE-2026-1092 https://nvd.nist.gov/vuln/detail/CVE-2026-1092 Wed, 08 Apr 2026 23:16:57 +0000 High CVE-2026-1092

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [Medium] CVE-2025-9484 – GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 bef... https://nvd.nist.gov/vuln/detail/CVE-2025-9484 https://nvd.nist.gov/vuln/detail/CVE-2025-9484 Wed, 08 Apr 2026 23:16:57 +0000 Medium CVE-2025-9484

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [High] CVE-2025-12664 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 ... https://nvd.nist.gov/vuln/detail/CVE-2025-12664 https://nvd.nist.gov/vuln/detail/CVE-2025-12664 Wed, 08 Apr 2026 23:16:56 +0000 High CVE-2025-12664

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2026-2370 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 ... https://nvd.nist.gov/vuln/detail/CVE-2026-2370 https://nvd.nist.gov/vuln/detail/CVE-2026-2370 Mon, 30 Mar 2026 00:16:01 +0000 High CVE-2026-2370

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

CVSS: 8.1 · CWE: CWE-233

View on NVD

]]> [High] CVE-2026-3988 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3988 https://nvd.nist.gov/vuln/detail/CVE-2026-3988 Wed, 25 Mar 2026 17:17:09 +0000 High CVE-2026-3988

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

CVSS: 7.5 · CWE: CWE-407

View on NVD

]]> [High] CVE-2026-3857 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10... https://nvd.nist.gov/vuln/detail/CVE-2026-3857 https://nvd.nist.gov/vuln/detail/CVE-2026-3857 Wed, 25 Mar 2026 17:17:09 +0000 High CVE-2026-3857

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

CVSS: 8.1 · CWE: CWE-352

View on NVD

]]> [High] CVE-2026-2995 – GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-2995 https://nvd.nist.gov/vuln/detail/CVE-2026-2995 Wed, 25 Mar 2026 17:16:58 +0000 High CVE-2026-2995

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content.

CVSS: 7.7 · CWE: CWE-80

View on NVD

]]> [Medium] CVE-2026-2973 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 ... https://nvd.nist.gov/vuln/detail/CVE-2026-2973 https://nvd.nist.gov/vuln/detail/CVE-2026-2973 Wed, 25 Mar 2026 17:16:58 +0000 Medium CVE-2026-2973

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2026-2745 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 ... https://nvd.nist.gov/vuln/detail/CVE-2026-2745 https://nvd.nist.gov/vuln/detail/CVE-2026-2745 Wed, 25 Mar 2026 17:16:57 +0000 Medium CVE-2026-2745

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.

CVSS: 6.8 · CWE: CWE-288

View on NVD

]]> [Medium] CVE-2026-2726 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10... https://nvd.nist.gov/vuln/detail/CVE-2026-2726 https://nvd.nist.gov/vuln/detail/CVE-2026-2726 Wed, 25 Mar 2026 17:16:57 +0000 Medium CVE-2026-2726

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to perform unauthorized actions on merge requests in other projects due to improper access control during cross-repository operations.

CVSS: 4.3 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-1724 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-1724 https://nvd.nist.gov/vuln/detail/CVE-2026-1724 Wed, 25 Mar 2026 17:16:29 +0000 Medium CVE-2026-1724

GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

CVSS: 6.8 · CWE: CWE-306

View on NVD

]]> [Medium] CVE-2025-14595 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 bef... https://nvd.nist.gov/vuln/detail/CVE-2025-14595 https://nvd.nist.gov/vuln/detail/CVE-2025-14595 Wed, 25 Mar 2026 17:16:27 +0000 Medium CVE-2025-14595

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user with Planner role to view security category metadata and attributes in group security configuration due to improper access control

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2025-13436 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13436 https://nvd.nist.gov/vuln/detail/CVE-2025-13436 Wed, 25 Mar 2026 17:16:27 +0000 Medium CVE-2025-13436

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2025-13078 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10... https://nvd.nist.gov/vuln/detail/CVE-2025-13078 https://nvd.nist.gov/vuln/detail/CVE-2025-13078 Wed, 25 Mar 2026 17:16:26 +0000 Medium CVE-2025-13078

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration inputs.

CVSS: 6.5 · CWE: CWE-1284

View on NVD

]]> [Low] CVE-2026-4363 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-4363 https://nvd.nist.gov/vuln/detail/CVE-2026-4363 Wed, 25 Mar 2026 15:16:50 +0000 Low CVE-2026-4363

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

CVSS: 3.7 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-1182 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1182 https://nvd.nist.gov/vuln/detail/CVE-2026-1182 Thu, 12 Mar 2026 02:15:58 +0000 Medium CVE-2026-1182

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to gain unauthorized access to confidential issue title created in public projects under certain circumstances.

CVSS: 4.3 · CWE: CWE-212

View on NVD

]]> [Medium] CVE-2025-12555 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 ... https://nvd.nist.gov/vuln/detail/CVE-2025-12555 https://nvd.nist.gov/vuln/detail/CVE-2025-12555 Wed, 11 Mar 2026 17:16:50 +0000 Medium CVE-2025-12555

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD disabled due to improper authorization checks.

CVSS: 4.3 · CWE: CWE-863

View on NVD

]]> [Medium] CVE-2026-3848 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 ... https://nvd.nist.gov/vuln/detail/CVE-2026-3848 https://nvd.nist.gov/vuln/detail/CVE-2026-3848 Wed, 11 Mar 2026 16:16:47 +0000 Medium CVE-2026-3848

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.

CVSS: 5.0 · CWE: CWE-93

View on NVD

]]> [Medium] CVE-2026-1732 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1732 https://nvd.nist.gov/vuln/detail/CVE-2026-1732 Wed, 11 Mar 2026 16:16:22 +0000 Medium CVE-2026-1732

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue titles due to improper filtering under certain circumstances.

CVSS: 4.3 · CWE: CWE-212

View on NVD

]]> [Medium] CVE-2026-1663 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1663 https://nvd.nist.gov/vuln/detail/CVE-2026-1663 Wed, 11 Mar 2026 16:16:22 +0000 Medium CVE-2026-1663

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to create labels in private projects due to improper authorization validation in the group import process under certain circumstances.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-1230 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1230 https://nvd.nist.gov/vuln/detail/CVE-2026-1230 Wed, 11 Mar 2026 16:16:22 +0000 Medium CVE-2026-1230

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause repository downloads to contain different code than displayed in the web interface due to incorrect validation of branch references under certain circumstances.

CVSS: 4.1 · CWE: CWE-706

View on NVD

]]> [High] CVE-2026-1090 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1090 https://nvd.nist.gov/vuln/detail/CVE-2026-1090 Wed, 11 Mar 2026 16:16:22 +0000 High CVE-2026-1090

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.

CVSS: 8.7 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-1069 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1069 https://nvd.nist.gov/vuln/detail/CVE-2026-1069 Wed, 11 Mar 2026 16:16:22 +0000 High CVE-2026-1069

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances.

CVSS: 7.5 · CWE: CWE-674

View on NVD

]]> [Medium] CVE-2026-0602 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-0602 https://nvd.nist.gov/vuln/detail/CVE-2026-0602 Wed, 11 Mar 2026 16:16:22 +0000 Medium CVE-2026-0602

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in the snippet rendering process under certain circumstances.

CVSS: 4.3 · CWE: CWE-288

View on NVD

]]> [High] CVE-2025-14513 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11... https://nvd.nist.gov/vuln/detail/CVE-2025-14513 https://nvd.nist.gov/vuln/detail/CVE-2025-14513 Wed, 11 Mar 2026 16:16:19 +0000 High CVE-2025-14513

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [High] CVE-2025-13929 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 ... https://nvd.nist.gov/vuln/detail/CVE-2025-13929 https://nvd.nist.gov/vuln/detail/CVE-2025-13929 Wed, 11 Mar 2026 16:16:19 +0000 High CVE-2025-13929

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2025-13690 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11... https://nvd.nist.gov/vuln/detail/CVE-2025-13690 https://nvd.nist.gov/vuln/detail/CVE-2025-13690 Wed, 11 Mar 2026 16:16:18 +0000 Medium CVE-2025-13690

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under certain conditions.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Low] CVE-2025-12704 – GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 bef... https://nvd.nist.gov/vuln/detail/CVE-2025-12704 https://nvd.nist.gov/vuln/detail/CVE-2025-12704 Wed, 11 Mar 2026 16:16:18 +0000 Low CVE-2025-12704

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain conditions.

CVSS: 3.5 · CWE: CWE-862

View on NVD

]]> [Low] CVE-2025-12697 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 ... https://nvd.nist.gov/vuln/detail/CVE-2025-12697 https://nvd.nist.gov/vuln/detail/CVE-2025-12697 Wed, 11 Mar 2026 16:16:18 +0000 Low CVE-2025-12697

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions.

CVSS: 2.2 · CWE: CWE-116

View on NVD

]]> [Medium] CVE-2025-12576 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 b... https://nvd.nist.gov/vuln/detail/CVE-2025-12576 https://nvd.nist.gov/vuln/detail/CVE-2025-12576 Wed, 11 Mar 2026 16:16:18 +0000 Medium CVE-2025-12576

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that under certain conditions could have allowed an authenticated user to cause a denial of service due to improper handling of webhook response data.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2026-2845 – An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 be... https://nvd.nist.gov/vuln/detail/CVE-2026-2845 https://nvd.nist.gov/vuln/detail/CVE-2026-2845 Wed, 25 Feb 2026 21:16:44 +0000 Medium CVE-2026-2845

An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2026-1747 – GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 be... https://nvd.nist.gov/vuln/detail/CVE-2026-1747 https://nvd.nist.gov/vuln/detail/CVE-2026-1747 Wed, 25 Feb 2026 21:16:36 +0000 Medium CVE-2026-1747

GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages.

CVSS: 4.3 · CWE: CWE-288

View on NVD

]]> [Medium] CVE-2026-1725 – GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 befo... https://nvd.nist.gov/vuln/detail/CVE-2026-1725 https://nvd.nist.gov/vuln/detail/CVE-2026-1725 Wed, 25 Feb 2026 21:16:36 +0000 Medium CVE-2026-1725

GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.

CVSS: 5.3 · CWE: CWE-770

View on NVD

]]> [High] CVE-2026-1662 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1662 https://nvd.nist.gov/vuln/detail/CVE-2026-1662 Wed, 25 Feb 2026 21:16:36 +0000 High CVE-2026-1662

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

CVSS: 7.5 · CWE: CWE-770

View on NVD

]]> [High] CVE-2026-1388 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1388 https://nvd.nist.gov/vuln/detail/CVE-2026-1388 Wed, 25 Feb 2026 21:16:36 +0000 High CVE-2026-1388

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

CVSS: 7.5 · CWE: CWE-1333

View on NVD

]]> [High] CVE-2026-0752 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 ... https://nvd.nist.gov/vuln/detail/CVE-2026-0752 https://nvd.nist.gov/vuln/detail/CVE-2026-0752 Wed, 25 Feb 2026 21:16:36 +0000 High CVE-2026-0752

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into the Mermaid sandbox UI.

CVSS: 8.0 · CWE: CWE-79

View on NVD

]]> [High] CVE-2025-14511 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14511 https://nvd.nist.gov/vuln/detail/CVE-2025-14511 Wed, 25 Feb 2026 21:16:30 +0000 High CVE-2025-14511

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

CVSS: 7.5 · CWE: CWE-1284

View on NVD

]]> [Medium] CVE-2025-3525 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 b... https://nvd.nist.gov/vuln/detail/CVE-2025-3525 https://nvd.nist.gov/vuln/detail/CVE-2025-3525 Wed, 25 Feb 2026 20:21:29 +0000 Medium CVE-2025-3525

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under certain circumstances, allowed an authenticated user with certain access to cause Denial of Service by creating specially crafted CI triggers via the API.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2025-14103 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 ... https://nvd.nist.gov/vuln/detail/CVE-2025-14103 https://nvd.nist.gov/vuln/detail/CVE-2025-14103 Wed, 25 Feb 2026 20:20:07 +0000 Medium CVE-2025-14103

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthorized user with Developer-role permissions to set pipeline variables for manually triggered jobs under certain conditions.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2026-1458 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 b... https://nvd.nist.gov/vuln/detail/CVE-2026-1458 https://nvd.nist.gov/vuln/detail/CVE-2026-1458 Wed, 11 Feb 2026 12:16:04 +0000 Medium CVE-2026-1458

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2026-1456 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1456 https://nvd.nist.gov/vuln/detail/CVE-2026-1456 Wed, 11 Feb 2026 12:16:04 +0000 Medium CVE-2026-1456

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Medium] CVE-2026-1387 – GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 bef... https://nvd.nist.gov/vuln/detail/CVE-2026-1387 https://nvd.nist.gov/vuln/detail/CVE-2026-1387 Wed, 11 Feb 2026 12:16:04 +0000 Medium CVE-2026-1387

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl.

CVSS: 6.5 · CWE: CWE-770

View on NVD

]]> [Low] CVE-2026-1282 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 ... https://nvd.nist.gov/vuln/detail/CVE-2026-1282 https://nvd.nist.gov/vuln/detail/CVE-2026-1282 Wed, 11 Feb 2026 12:16:04 +0000 Low CVE-2026-1282

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles.

CVSS: 3.5 · CWE: CWE-80

View on NVD

]]>