GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: rke2-runtime, elvish, gitlab-operator-fips, dex, kcp, crossplane-provider-aws-rds-fips, kafkaexporter-fips, vexctl, cluster-proportional-autoscaler, multus-cni-fips, gitlab-workhorse-ce, kubernetes-dashboard, lazygit, licenseclassifier,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, direnv, aws-flb-firehose-fips, kube-arangodb, kcp, crossplane-provider-aws-rds-fips, dask-gateway, dockerize, crossplane-provider-family-azure, kafkaexporter-fips, apache-exporter,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, dex, tempo, eksctl, ceph-csi-operator, direnv, aws-flb-firehose-fips, kube-arangodb, kcp, crossplane-provider-aws-rds-fips, dask-gateway, dockerize, crossplane-provider-family-azure, kafkaexporter-fips, apache-exporter,...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: barman, gitlab-cng-fips, superset, mitmproxy, nemo, metaflow-service, kserve, jupyter-base-notebook, authentik, kubeflow-jupyter-web-app, ggshield, prefect, dask-kubernetes, airflow, semgrep, kubeflow-volumes-web-app, openstack-kolla-toolbox-2025.1, mlflow, mycli,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: barman, gitlab-cng-fips, superset, mitmproxy, nemo, metaflow-service, kserve, jupyter-base-notebook, authentik, kubeflow-jupyter-web-app, ggshield, prefect, dask-kubernetes, airflow, semgrep, kubeflow-volumes-web-app, openstack-kolla-toolbox-2025.1, mlflow, mycli,...

FreeBSD : Gitlab -- vulnerabilities (099d4998-33cc-11f1-a7d1-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 099d4998-33cc-11f1-a7d1-2cf05da270f3 advisory. Gitlab reports: Exposed Method issue in websocket connections impacts GitLab CE/EE Denial of...

EUVD-2026-20795

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in t...

EUVD-2025-209365

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries...

EUVD-2026-20791

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries...

EUVD-2025-209367

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries...

EUVD-2026-20799

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to...

EUVD-2026-20802

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control...

EUVD-2026-20789

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads...

EUVD-2026-20793

GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content...

EUVD-2026-20801

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with custom role permissions to demote or remove higher-privileged group members due to improper authorization...

EUVD-2026-20797

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to access confidential issues assigned to other users via CSV export due to insufficient authorization checks...

PT-2026-33613

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.7 through 18.8.8 GitLab CE/EE versions 18.9 through 18.9.4 GitLab CE/EE versions 18.10 through 18.10.2 Description An issue exists where importing CSV files allows an authenticated user to cause a denial of service to...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE arises from incorrect input of configuration data, allowing a perpetrator to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to incorrect input of configuration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE involves a lack of authentication, which allows attackers to disclose protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to the lack of authentication. Exploiting this vulnerability can allow a malicious actor, operating remotely, to expose the protected information...

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE, related to improper code generation management, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE is related to improper management of code generation. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality of protected information...