PT-2026-24714

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 18.7.6 GitLab CE/EE versions 18.8 prior to 18.8.6 GitLab CE/EE versions 18.9 prior to 18.9.2 Description An authenticated user could potentially cause repository downloads to contain different code than displayed...

PT-2026-24706

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions...

GitLab security vulnerabilities

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Vulnerabilities exist in versions prior to GitLab CE/EE 18.7.6, 18.8.6,...

PT-2026-24713

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the markdown placeholders feature flag was enabled, to inject JavaScript in a browser due to improper...

PT-2026-24709

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certai...

PT-2026-24707

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain...

CVE-2025-14513: Improper Validation of Specified Quantity in Input

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON...

GitLab security vulnerabilities

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Vulnerabilities exist in versions of GitLab CE/EE before 18.7.6, 18.8.6...

CVE-2026-27137 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, amazon-k8s-cni-fips, aws-load-balancer-controller-fips, librechat, cluster-autoscaler-fips, flux-source-controller, victorialogs, omnictl-multiarch, flux-image-reflector-controller, nova-fips, victoriametrics-cluster-fips,...

CVE-2026-27138 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, amazon-k8s-cni-fips, aws-load-balancer-controller-fips, librechat, cluster-autoscaler-fips, flux-source-controller, victorialogs, omnictl-multiarch, flux-image-reflector-controller, nova-fips, victoriametrics-cluster-fips,...

GHSA-7HFW-R8QC-89V4 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, amazon-k8s-cni-fips, aws-load-balancer-controller-fips, librechat, cluster-autoscaler-fips, flux-source-controller, victorialogs, omnictl-multiarch, flux-image-reflector-controller, nova-fips, victoriametrics-cluster-fips,...

GHSA-PH5J-38MG-J6HP vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, amazon-k8s-cni-fips, aws-load-balancer-controller-fips, librechat, cluster-autoscaler-fips, flux-source-controller, victorialogs, omnictl-multiarch, flux-image-reflector-controller, nova-fips, victoriametrics-cluster-fips,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: k8sgpt, terraform-provider-azuread, buildah, external-dns, thanos, cloud-provider-aws, gitleaks, kapp, pgtimetable, nri-rabbitmq, nsc, redis-operator, actions-runner-controller, mattermost, kube-bench, kyverno, local-static-provisioner, falcoctl, cilium-envoy,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: kubecolor, k8sgpt, terraform-provider-azuread, buildah, external-dns, thanos, cloud-provider-aws, gitleaks, kapp, pgtimetable, nri-rabbitmq, nsc, redis-operator, actions-runner-controller, mattermost, kube-bench, kyverno, local-static-provisioner, falcoctl,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: kubecolor, k8sgpt, terraform-provider-azuread, buildah, external-dns, thanos, cloud-provider-aws, gitleaks, kapp, pgtimetable, nri-rabbitmq, nsc, redis-operator, actions-runner-controller, mattermost, kube-bench, kyverno, local-static-provisioner, falcoctl,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: terraform-provider-pagerduty, kube-metrics-adapter, coredns, k8sgpt, knative-client, kube-fluentd-operator, terraform-provider-azuread, temporal-server, podinfo, ksops, secrets-store-csi-driver-provider-aws, fscrypt, crossplane-provider-aws-rds, buildah,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: terraform-provider-pagerduty, kube-metrics-adapter, coredns, k8sgpt, knative-client, kube-fluentd-operator, terraform-provider-azuread, temporal-server, podinfo, ksops, secrets-store-csi-driver-provider-aws, fscrypt, crossplane-provider-aws-rds, buildah,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator-fips, amazon-k8s-cni, rabbitmq-cluster-operator, argo-workflows-fips, hydra-fips, pulumi-kubernetes-operator, chaos-mesh, croc, amass, backup-restore-operator, cloudbeat-fips, step-fips, zitadel, kubernetes-csi-external-snapshotter,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, hydra-fips, pulumi-kubernetes-operator, chaos-mesh, backup-restore-operator, cloudbeat-fips, step-fips, zitadel, kubernetes-csi-external-snapshotter, tigera-operator-fips, volume-modifier-for-k8s, envconsul-fips, etcd-fips, kuma,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator-fips, amazon-k8s-cni, rabbitmq-cluster-operator, argo-workflows-fips, hydra-fips, pulumi-kubernetes-operator, chaos-mesh, croc, amass, backup-restore-operator, cloudbeat-fips, step-fips, zitadel, kubernetes-csi-external-snapshotter,...