CVE-2026-1868

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

CVE-2026-1868: Improper Neutralization of Special Elements Used in a Template Engine

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

GitLab AI Gateway security vulnerabilities

GitLab AI Gateway is an artificial intelligence service middleware provided by the US company GitLab. Versions 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 of GitLab AI Gateway contain security vulnerabilities. These vulnerabilities stem from insecure template extensions of data provided ...

Duo Workflow Service Code Execution

The vulnerability of the Duo Workflow Service component, a service for interacting with external LLM-providers like GitLab AI Gateway, is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted request...

PT-2026-6978

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.1.6 through 18.8.0 Description The GitLab AI Gateway’s Duo Workflow Service component contains a flaw related to improper code generation. This issue allows authenticated attackers to cause a Denial of Service or...

BIT-GITLAB-2026-1751 Missing Authorization in GitLab

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer-fips, gitlab-operator, mariadb-operator, aws-privateca-issuer, cert-manager-csi-driver, opentelemetry-operator, cert-manager-google-cas-issuer, cert-manager-webhook-pdns-fips, percona-xtradb-cluster-operator-fips, cert-manager-webhook-pdns,...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer-fips, gitlab-operator, mariadb-operator, aws-privateca-issuer, cert-manager-csi-driver, opentelemetry-operator, cert-manager-google-cas-issuer, cert-manager-webhook-pdns-fips, percona-xtradb-cluster-operator-fips, cert-manager-webhook-pdns,...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2019-19006link is external Sangoma FreePBX Improper Authentication Vulnerability CVE-2021-39935link is external GitLab Community and Enterprise Editions...

CVE-2026-1751

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions...

Linux Distros Unpatched Vulnerability : CVE-2026-1751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge...

Linux Distros Unpatched Vulnerability : CVE-2025-13978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowe...

GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API...

Linux Distros Unpatched Vulnerability : CVE-2025-4097

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow...

CVE-2025-24293 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

CVE-2024-8796 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

GHSA-R4MG-4433-C7G3 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

GHSA-QJXF-MC72-WJR2 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

CVE-2026-1751

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions...

UBUNTU-CVE-2026-1751

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions...