PT-2025-41395

Name of the Vulnerable Software and Affected Versions BBOT affected versions not specified Description The gitlab module in BBOT may allow an attacker to disclose a GitLab API key to a server under their control by using a maliciously formatted git URL. This could potentially lead to unauthorized...

CVE-2025-10282: Exposure of Sensitive Information to an Unauthorized Actor

BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL...

GitLab Enterprise Edition security vulnerabilities

GitLab Enterprise Edition EE is a content management system from GitLab, Inc. in the United States. A security vulnerability exists in GitLab Enterprise Edition EE versions 18.3 through 18.3.4 and 18.4 through 18.4.2, which stems from an incorrect GraphQL mutation range that could cause an...

CVE-2025-11340: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scope...

CVE-2025-10004: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs...

BBOT security vulnerabilities

BBOT is a recursive Internet scanner open-sourced by Black Lantern Security. BBOT suffers from a security vulnerability that stems from a maliciously formatted git URL that could lead to the disclosure of GitLab API keys to an attacker-controlled server...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. in the United States, with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE and EE...

PT-2025-42746

Name of the Vulnerable Software and Affected Versions GitLab affected versions not specified Description A security issue exists in the GitLab code collaboration platform due to a missing authorization procedure. Remote attackers may be able to gain unauthorized access to protected information by...

GitLab 5.2 < 18.2.8 / 18.3 < 18.3.4 / 18.4 < 18.4.2 (CVE-2025-2934)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to crea...

GitLab 13.12 < 18.2.8 / 18.3 < 18.3.4 / 18.4 < 18.4.2 (CVE-2025-10004)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE and EE versions 5.2 up to and...

CVE-2025-2934: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTT...

GitLab 18.3 < 18.3.4 / 18.4 < 18.4.2 (CVE-2025-11340)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens ...

GHSA-W9PC-FMGC-VXVW vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.2-rails, logstash, ruby3.3-rails, ruby3.4-rack, ruby3.4-rails, gitlab-cng, ruby3.2-rack...

GHSA-P543-XPFM-54CP vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.2-rails, logstash, ruby3.3-rails, ruby3.4-rack, ruby3.4-rails, gitlab-cng, ruby3.2-rack...

CVE-2025-61771 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.2-rails, logstash, ruby3.3-rails, ruby3.4-rack, ruby3.4-rails, gitlab-cng, ruby3.2-rack...

CVE-2025-61772 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.2-rails, logstash, ruby3.3-rails, ruby3.4-rack, ruby3.4-rails, gitlab-cng, ruby3.2-rack...

CVE-2025-61770 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.2-rails, logstash, ruby3.3-rails, ruby3.4-rack, ruby3.4-rails, gitlab-cng, ruby3.2-rack...

GHSA-WPV5-97WM-HP9C vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, gitlab-rails-ce, ruby4.0-rack, ruby3.2-rails, logstash, ruby3.3-rails, ruby3.4-rack, ruby3.4-rails, gitlab-cng, ruby3.2-rack...

PT-2025-41364

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.3 through 18.3.4 GitLab EE versions 18.4 through 18.4.2 Description An authorization issue exists in the GitLab EE GraphQL API. Incorrectly scoped GraphQL mutations could allow authenticated users with read-only API token...