CVE-2025-14560

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious conten...

CVE-2026-1458: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files...

PT-2026-7519

GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain permissions to make unauthorized requests to internal network services throug...

CVE-2026-1080

GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API...

CVE-2026-1458

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files...

GitLab cross-site scripting vulnerabilities

GitLab is an end-to-end software development platform provided by the American company GitLab. It includes built-in features such as version control, issue tracking, code review, and CI/CD Continuous Integration and Delivery. Versions of GitLab prior to GitLab CE and EE 18.6.6, including 17.1.x,...

CVE-2025-14560: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious conten...

CVE-2026-1080: Authorization Bypass Through User-Controlled Key

GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: wolfictl, bom, guac, kubevela, gitea, src-fingerprint, flux-source-controller, grafana-alloy, witness, xeol, nuclei, rancher-fleet, grype, k9s, gitlab-runner, apko, kargo, timoni, goreleaser, steampipe, gomplate, argo-cd, gitsign, syft, zot, kots, cerbos,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: wolfictl, bom, guac, kubevela, gitea, src-fingerprint, flux-source-controller, grafana-alloy, witness, xeol, nuclei, rancher-fleet, grype, k9s, gitlab-runner, apko, kargo, timoni, goreleaser, steampipe, gomplate, argo-cd, gitsign, syft, zot, kots, cerbos,...

CVE-2026-25934 vulnerabilities

Vulnerabilities for packages: cloudbeat, crossplane, grype-db, timoni, gitlab-runner, google-osconfig-agent, grype, flux-source-watcher-fips, trivy, skaffold, snyk-cli, pulumi-language-java, grype-fips, kyverno-fips, dagger, argocd-image-updater-fips, kargo, flux-kustomize-controller-fips, bom,...

GHSA-37CX-329C-33X3 vulnerabilities

Vulnerabilities for packages: cloudbeat, crossplane, grype-db, timoni, gitlab-runner, google-osconfig-agent, grype, flux-source-watcher-fips, trivy, skaffold, snyk-cli, pulumi-language-java, grype-fips, kyverno-fips, dagger, argocd-image-updater-fips, kargo, flux-kustomize-controller-fips, bom,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: spiffe-helper, http-echo, kapp, rancher-helm, hivemind, kubernetes-csi-external-health-monitor, secrets-store-csi-driver, amazon-cloudwatch-agent-operator, capslock, terraform-provider-tls, spicedb-operator, pulumi-language-java, mattermost, chezmoi, gostatsd,...

GHSA-H355-32PF-P2XM vulnerabilities

Vulnerabilities for packages: spiffe-helper, http-echo, kapp, rancher-helm, kubernetes-csi-external-health-monitor, secrets-store-csi-driver, amazon-cloudwatch-agent-operator, terraform-provider-tls, spicedb-operator, pulumi-language-java, mattermost, chezmoi, gostatsd, otel-cli,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: spiffe-helper, http-echo, kapp, rancher-helm, kubernetes-csi-external-health-monitor, secrets-store-csi-driver, amazon-cloudwatch-agent-operator, terraform-provider-tls, spicedb-operator, pulumi-language-java, mattermost, chezmoi, gostatsd, otel-cli,...

PT-2026-7528

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.6.6 GitLab CE/EE versions 18.7 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 Description An issue exists in GitLab CE/EE related to incomplete validation within the Web IDE. This could allow an...

CVE-2026-1868

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

CVE-2026-1868

GitLab AI Gateway’s Duo Workflow Service was affected by an insecure template expansion defect in Duo Agent Platform Flow definitions across all 18.1.6–18.8.0 releases. The vulnerability could enable Denial of Service or remote code execution on the Gateway. Mitigation in the listed advisories is...

CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...

CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the Duo Workflow Service component of GitLab AI Gateway affecting all versions of the AI Gateway from 18.1.6, 18.2.6, 18.3.1 to 18.6.1, 18.7.0, and 18.8.0 in which AI Gateway was vulnerable to insecure template expansion of user supplied data via crafted D...