GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were security vulnerabilities in versions of GitLab CE/EE between 18...

PT-2026-40864

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.3 through 18.9.6 GitLab CE/EE versions 18.10 through 18.10.5 GitLab CE/EE versions 18.11 through 18.11.2 Description Improper access control allows an authenticated user with developer-role permissions to bypass packag...

GitLab 安全漏洞

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Vulnerabilities exist in versions of GitLab CE/EE from 9.0 to 18.9.7, a...

GitLab 18.3 < 18.9.7 / 18.10 < 18.10.6 / 18.11 < 18.11.3 (CVE-2026-3607)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Access Control Check Implemented After Asset is Accessed in GitLab CVE-2026-3607 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

CVE-2026-42195

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to ope...

PT-2026-40876

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.7 through 18.9.6 GitLab EE versions 18.10 through 18.10.5 GitLab EE versions 18.11 through 18.11.2 Description An issue in customizable analytics dashboards allows an authenticated user to execute arbitrary JavaScript in...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: kots, gitlab-runner, steampipe, kargo, melange, zarf, act, gitea, syft, argocd-image-updater, kubescape, pulumi-language-yaml, witness, src-fingerprint, external-secrets-operator, snyk-cli, wolfictl, grafana, tfsec, teleport, grype, trivy-operator, dagger, nuclei,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: kots, gitlab-runner, steampipe, kargo, melange, zarf, act, gitea, syft, argocd-image-updater, kubescape, pulumi-language-yaml, witness, src-fingerprint, external-secrets-operator, snyk-cli, wolfictl, grafana, tfsec, teleport, grype, trivy-operator, dagger, nuclei,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: crossplane, kyverno, apko-fips, cerbos, dagger, pulumi, pulumi-kubernetes-operator, trivy-fips, grype, external-secrets-operator-fips, gitlab-runner-fips, coder, kubescape-server, kubevela, flux, kargo, witness, kots, skaffold-fips, trufflehog, src-fingerprint,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: crossplane, kyverno, apko-fips, cerbos, dagger, pulumi, pulumi-kubernetes-operator, trivy-fips, grype, external-secrets-operator-fips, gitlab-runner-fips, coder, kubescape-server, kubevela, flux, kargo, witness, kots, skaffold-fips, trufflehog, src-fingerprint,...

GHSA-526F-JXPJ-JMG2 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-43870 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-44837 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-44836 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GHSA-HG3H-G7XC-F7VP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GHSA-7F3R-GWC9-2995 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-40295 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GHSA-JP94-3292-C3XV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of mcp-gitlab-server at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a uncovered that the SSE HTTP transport — advertised in the README and comparison table as a...

GHSA-8JR5-6GVJ-RFPF @yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of mcp-gitlab-server at commit 80a7b4cf3fba6b55389c0ef491a48190f7c8996a uncovered that the SSE HTTP transport — advertised in the README and comparison table as a...