GitLab XSS

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

GitLab Server-Side Request Forgery (SSRF) Vulnerability

GitLab contains a server-side request forgery SSRF vulnerability when requests to the internal network for webhooks are enabled...

CVE-2026-1282 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-pages-fips...

CVE-2026-1456 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-pages-fips...

CVE-2026-1458 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-pages-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-rails-ce-fips, gitlab-runner-fips, gitlab-workhorse-ce-fips...

GHSA-95P8-CCJW-3G7F vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-pages-fips...

GHSA-W487-9R9P-6P96 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-pages-fips...

CVE-2026-0595 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-pages-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-rails-ce-fips, gitlab-runner-fips, gitlab-workhorse-ce-fips...

GHSA-8F2F-6W9M-MG42 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-pages-fips...

GHSA-CF2V-M456-7QJF vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-pages-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-rails-ce-fips, gitlab-runner-fips, gitlab-workhorse-ce-fips...

GHSA-M668-XFWP-34X6 vulnerabilities

Vulnerabilities for packages: gitlab-runner, gitlab-pages-fips, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-rails-ce-fips, gitlab-runner-fips, gitlab-workhorse-ce-fips...

CVE-2026-1094 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-runner, gitlab-runner-fips, gitlab-pages-fips...

BIT-GITLAB-2026-1458 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files...

BIT-GITLAB-2026-1456 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processin...

BIT-GITLAB-2026-1282 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into project labels titles...

BIT-GITLAB-2026-1094 Improper Validation of Unsafe Equivalence in Input in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI...

BIT-GITLAB-2026-0958 Interpretation Conflict in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits...

BIT-GITLAB-2026-0595 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML injection in test...

BIT-GITLAB-2025-8099 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries...

BIT-GITLAB-2025-7659 Origin Validation Error in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private repositories by abusing incomplete validation in the Web IDE...