GitLab 安全漏洞

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD continuous integration and delivery. There were security vulnerabilities in versions prior to GitLab EE...

GitLab 跨站脚本漏洞

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Versions of GitLab before 18.6.6, 18.7.4, and 18.8.4 contained a...

GitLab 访问控制错误漏洞

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Vulnerabilities existed in versions prior to GitLab CE/EE 18.6.6, 18.7....

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: zot, melange, flux-image-automation-controller, pulumi, argocd-image-updater, pulumi-language-dotnet, gitaly, k9s, rancher-fleet, argo-events, chezmoi, witness, kots, gomplate, nuclei, scorecard, crossplane, bom, trivy-operator, apko, gitsign, skaffold, grype,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: zot, melange, flux-image-automation-controller, pulumi, argocd-image-updater, pulumi-language-dotnet, gitaly, k9s, rancher-fleet, argo-events, chezmoi, witness, kots, gomplate, nuclei, scorecard, crossplane, bom, trivy-operator, apko, gitsign, skaffold, grype,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: flux-source-watcher-fips, goreleaser, tekton-pipelines-fips, zarf, argocd-image-updater-fips, kubevela-fips, guac, packer-fips, kots, apko, tfsec, grype-fips, pulumi-language-dotnet, cloudbeat, trivy-operator-fips, xeol-fips, gitea, cerbos, dagger, argo-workflows,...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: flux-source-watcher-fips, goreleaser, tekton-pipelines-fips, zarf, argocd-image-updater-fips, kubevela-fips, guac, packer-fips, kots, apko, tfsec, grype-fips, pulumi-language-dotnet, cloudbeat, trivy-operator-fips, xeol-fips, gitea, cerbos, dagger, argo-workflows,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: mariadb-operator, libnvidia-container, terraform-provider-tls, mockery, memcached-exporter, sftpgo-plugin-auth, configmap-reload, gostatsd, whereabouts, helm-mapkubeapis, cluster-api-provider-vsphere, trino, local-path-provisioner, portieris,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: mariadb-operator, libnvidia-container, terraform-provider-tls, mockery, memcached-exporter, sftpgo-plugin-auth, configmap-reload, gostatsd, whereabouts, helm-mapkubeapis, age, metallb, cluster-api-provider-vsphere, trino, local-path-provisioner, portieris,...

GHSA-H355-32PF-P2XM vulnerabilities

Vulnerabilities for packages: mariadb-operator, libnvidia-container, terraform-provider-tls, mockery, memcached-exporter, sftpgo-plugin-auth, configmap-reload, gostatsd, whereabouts, helm-mapkubeapis, cluster-api-provider-vsphere, trino, local-path-provisioner, portieris,...

PT-2026-7528

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.6.6 GitLab CE/EE versions 18.7 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 Description An issue exists in GitLab CE/EE related to incomplete validation within the Web IDE. This could allow an...

CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

CVE-2026-1868

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

CVE-2026-1868

GitLab AI Gateway’s Duo Workflow Service was affected by an insecure template expansion defect in Duo Agent Platform Flow definitions across all 18.1.6–18.8.0 releases. The vulnerability could enable Denial of Service or remote code execution on the Gateway. Mitigation in the listed advisories is...

CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

GitLab AI Gateway 安全漏洞

GitLab AI Gateway is an artificial intelligence service middleware provided by the US company GitLab. Versions 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 of GitLab AI Gateway contain security vulnerabilities. These vulnerabilities stem from insecure template extensions of data provided ...

PT-2026-6978

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 18.8.0 Description The GitLab AI Gateway’s Duo Workflow Service component contains a flaw related to improper code generation. This issue allows authenticated attackers to cause a Denial of Service or...

BIT-GITLAB-2026-1751 Missing Authorization in GitLab

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: mariadb-operator-fips, cert-manager-webhook-pdns, percona-xtradb-cluster-operator-fips, percona-server-mongodb-operator-fips, gitlab-operator, mariadb-operator, percona-server-mongodb-operator, cert-manager-istio-csr-fips, opentelemetry-operator-fips,...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: mariadb-operator-fips, cert-manager-webhook-pdns, percona-xtradb-cluster-operator-fips, percona-server-mongodb-operator-fips, gitlab-operator, mariadb-operator, percona-server-mongodb-operator, cert-manager-istio-csr-fips, opentelemetry-operator-fips,...