22115 matches found
PT-2025-47053
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.9 through 18.3.5 GitLab CE/EE versions 18.4 through 18.4.3 GitLab CE/EE versions 18.5 through 18.5.1 Description An authenticated attacker could bypass access control restrictions and view GitLab Pages content intended...
BIT-GITLAB-2025-11702 Missing Authorization in GitLab
GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects...
CVE-2025-11702
GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects...
EUVD-2025-36789
Malicious code in @gitlab-lsp/pkg-1 npm...
Malicious Package
Overview @gitlab-lsp/pkg-1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in @gitlab-lsp/pkg-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7df0575a200975029552912084573cf0331e1cf02ccad8e8fd7e024536143ef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-48963 Malicious code in @gitlab-lsp/pkg-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf13c79e9bdc06f50391fa8a073bbe923119de6f064d8bc0a7333b6f98c87d9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2025-36787
Malicious code in @gitlab-lsp/workflow-api npm...
Malicious code in @gitlab-lsp/pkg-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf13c79e9bdc06f50391fa8a073bbe923119de6f064d8bc0a7333b6f98c87d9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @gitlab-lsp/workflow-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77c05dd20ff8e2d3c07051d2f1146ac86522b9a72a6964e27122c9dd02d4c7a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview @gitlab-lsp/pkg-2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2025-36788
Malicious code in @gitlab-lsp/pkg-2 npm...
Malicious Package
Overview @gitlab-test/pnpm-v9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in @gitlab-test/bun-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac471c58a2d40a399987d96cf13593df041d1f3baa4d4e19e047d1090a931f6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview @gitlab-test/npm-v10 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in @gitlab-test/pnpm-v9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 352b39cbb73b3231bb6a6698230853fb58dd0313c7187e98a39dba4502226b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2025-36795
Malicious code in @gitlab-test/npm-v10 npm...
MAL-2025-48968 Malicious code in @gitlab-test/yarn-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f274342e8c6f4a200134b68b571eb1eb5d9f01c5d28f5d445b0da3fff6808ff1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview @gitlab-test/yarn-v4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...