PT-2026-32412

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries...

Linux Distros Unpatched Vulnerability : CVE-2026-4332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable...

Linux Distros Unpatched Vulnerability : CVE-2026-1752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed...

Linux Distros Unpatched Vulnerability : CVE-2026-1516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality...

Linux Distros Unpatched Vulnerability : CVE-2026-2619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, wuzz, victoriametrics, minio-object-browser, aws-privateca-issuer, timescaledb-parallel-copy, argo-workflows, aws-eks-pod-identity-agent, lazygit, helm-push, dataplaneapi, knative-client, aws-nuke, direnv, flux, tigera-operator,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, eksctl, aws-flb-firehose-fips, kube-arangodb, dask-gateway, cloud-provider-aws, malcontent, tekton-pipelines, libnvidia-container, gitlab-workhorse-ce, kubernetes-dashboard, external-dns, k9s-fips, licenseclassifier,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, aws-flb-firehose-fips, kube-arangodb, crossplane-provider-aws-rds-fips, dask-gateway, crossplane-provider-family-azure, apache-exporter, cloud-provider-aws, yunikorn-k8shim, vexctl,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, aws-flb-firehose-fips, kube-arangodb, crossplane-provider-aws-rds-fips, dask-gateway, crossplane-provider-family-azure, apache-exporter, cloud-provider-aws, yunikorn-k8shim, vexctl,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, eksctl, aws-flb-firehose-fips, kube-arangodb, dask-gateway, cloud-provider-aws, malcontent, tekton-pipelines, libnvidia-container, gitlab-workhorse-ce, kubernetes-dashboard, external-dns, k9s-fips, licenseclassifier,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, direnv, aws-flb-firehose-fips, kube-arangodb, kcp, crossplane-provider-aws-rds-fips, dask-gateway, dockerize, crossplane-provider-family-azure, kafkaexporter-fips, apache-exporter,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, direnv, aws-flb-firehose-fips, kube-arangodb, kcp, crossplane-provider-aws-rds-fips, dask-gateway, dockerize, crossplane-provider-family-azure, kafkaexporter-fips, apache-exporter,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, direnv, aws-flb-firehose-fips, kube-arangodb, kcp, crossplane-provider-aws-rds-fips, dask-gateway, dockerize, crossplane-provider-family-azure, kafkaexporter-fips, apache-exporter,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: rke2-runtime, elvish, gitlab-operator-fips, dex, kcp, crossplane-provider-aws-rds-fips, kafkaexporter-fips, vexctl, cluster-proportional-autoscaler, multus-cni-fips, gitlab-workhorse-ce, kubernetes-dashboard, lazygit, licenseclassifier,...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: barman, gitlab-cng-fips, superset, mitmproxy, nemo, metaflow-service, kserve, jupyter-base-notebook, authentik, kubeflow-jupyter-web-app, ggshield, prefect, dask-kubernetes, airflow, semgrep, kubeflow-volumes-web-app, openstack-kolla-toolbox-2025.1, mlflow, mycli,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: barman, gitlab-cng-fips, superset, mitmproxy, nemo, metaflow-service, kserve, jupyter-base-notebook, authentik, kubeflow-jupyter-web-app, ggshield, prefect, dask-kubernetes, airflow, semgrep, kubeflow-volumes-web-app, openstack-kolla-toolbox-2025.1, mlflow, mycli,...

FreeBSD : Gitlab -- vulnerabilities (099d4998-33cc-11f1-a7d1-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 099d4998-33cc-11f1-a7d1-2cf05da270f3 advisory. Gitlab reports: Exposed Method issue in websocket connections impacts GitLab CE/EE Denial of...

EUVD-2026-20795

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...

EUVD-2026-20801

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization...

EUVD-2025-209367

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries...