CVE-2026-10087 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a...

CVE-2026-10733 Improper Restriction of Rendered UI Layers or Frames in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

CVE-2026-10733 Improper Restriction of Rendered UI Layers or Frames in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

EUVD-2026-36222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization...

CVE-2026-10733

GitLab CVE-2026-10733 affects GitLab CE/EE versions prior to 18.10.8 (from 17.0 line), 18.11 prior to 18.11.5, and 19.0 prior to 19.0.2. Root cause: improper sanitization that could allow an authenticated user to cause a denial-of-service on the CI/CD Catalog page. Remediation: upgrade to the pat...

SUSE-SU-2026:2365-1 Security update for cosign

This update for cosign fixes the following issue - CVE-2026-39395: Incorrect attestation verification due to malformed payloads or mismatched predicate types bsc1261859. Changes for cosign: - update to 3.0.6: Fix DSSE predicate check GHSA-w6c6-c85g-mmv6 4801 Handle whitespace-only certificate...

CVE-2026-47240 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails, jruby, logstash-fips, ruby4.0-rails, truffleruby, logstash...

GHSA-8P34-64R3-MWG8 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails, jruby, logstash-fips, ruby4.0-rails, truffleruby, logstash...

GHSA-46Q3-7GV7-QMGG vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails, jruby, logstash-fips, ruby4.0-rails, truffleruby, logstash...

CVE-2026-47242 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails, jruby, logstash-fips, ruby4.0-rails, truffleruby, logstash...

CVE-2026-47241 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails, jruby, logstash-fips, ruby4.0-rails, truffleruby, logstash...

GHSA-C4FP-CXRR-MJ66 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.3-rails, kube-logging-operator, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails, ruby3.2-rails, jruby, logstash-fips, ruby4.0-rails, truffleruby, logstash...

CVE-2026-10087

creationtimestamp| type| source ---|---|--- 2026-06-11 01:08:31+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-16 2026-06-11 12:45:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 13:42:39+00:00| seen|...

CVE-2026-7250

creationtimestamp| type| source ---|---|--- 2026-06-11 01:08:31+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-16 2026-06-11 12:45:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 18:00:00+00:00| seen|...

CVE-2026-8589

creationtimestamp| type| source ---|---|--- 2026-06-11 01:08:31+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-su-gitlab-ce/ee-16 2026-06-11 12:45:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 14:22:43+00:00| seen|...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were security vulnerabilities in versions of GitLab CE/EE between 15...

GitLab 资源管理错误漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. Versions of GitLab CE/EE prior to 12.0, 18.10.8, 18.11.5, and 19.0.2...

GitLab 处理逻辑错误漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were security vulnerabilities in versions prior to 17.0, 18.11,...

GitLab 跨站脚本漏洞

GitLab Enterprise Edition EE is a content management system provided by the American company GitLab. Versions of GitLab EE from 17.1 to 18.10.8, 18.11 to 18.11.5, and 19.0 to 19.0.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper input in the analysis...

PT-2026-48655

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1.4 through 18.10.7 GitLab EE versions 18.11 through 18.11.4 GitLab EE versions 19.0 through 19.0.1 Description An issue exists where an authenticated user can add unauthorized email addresses to a targeted user's account...