CVE-2025-2937

GitLab CE/EE vulnerability CVE-2025-2937 affects all versions 13.2–18.0.5, 18.1.x before 18.1.4, and 18.2.x before 18.2.2. Authenticated users may trigger a denial of service by sending specially crafted markdown payloads to the Wiki feature. No remediation details are provided in the supplied do...

CVE-2025-2937

Removed by vendor...

CVE-2025-5819 Incorrect Permission Assignment for Critical Resource in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances...

CVE-2025-6186 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names...

CVE-2025-6186

Removed by vendor...

CVE-2025-6186

CVE-2025-6186 affects GitLab CE/EE: all versions from 18.1 before 18.1.4 and 18.2 before 18.2.2. The issue allows authenticated users to potentially take over accounts by injecting malicious HTML into work item names. Connected sources (OSV entries) confirm the same description and affected versi...

CVE-2025-6186 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names...

CVE-2025-7739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...

CVE-2025-7739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions...

CVE-2025-7739

GitLab CE/EE CVE-2025-7739 affects all versions 18.2 prior to 18.2.2. Under certain conditions, authenticated users could perform stored cross-site scripting by injecting malicious HTML into scoped label descriptions. Root cause described as a stored XSS vulnerability; exploitation status not det...

CVE-2025-8770 Authorization Bypass Through User-Controlled Key in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers...

CVE-2025-8770

CVE-2025-8770 describes a vulnerability in GitLab EE where authenticated users with specific access could bypass merge request approval policies by manipulating approval rule identifiers. Affected versions are GitLab EE 18.0 up to before 18.0.6, 18.1 up to before 18.1.4, and 18.2 up to before 18....

CVE-2025-8770 Authorization Bypass Through User-Controlled Key in GitLab

An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers...

PT-2025-33058 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab EE versions prior to 18.0.6 GitLab EE versions prior to 18.1.4 GitLab EE versions prior to 18.2.2 Description: An issue exists in GitLab EE that allows authenticated users with specific access to bypass merge request approval policies ...

PT-2025-33079 · Unknown · Quickshare File Server

Name of the Vulnerable Software and Affected Versions: QuickShare File Server version 1.2.1 Description: QuickShare File Server version 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this fla...

PT-2025-33056 · Unknown · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 18.2 through 18.2.1 Description: An issue allows authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions. Recommendations: Update to version 18.2.2 or...

Part-DB 安全漏洞

Part-DB is a web-based database for managing electronic components from Part-DB Open Source. A security vulnerability exists in Part-DB versions prior to 1.17.3, which stems from the fact that authenticated users can upload files with misleading extensions, potentially leading to a denial of...

PT-2025-33041 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.7 through 18.0.5 GitLab CE/EE versions 18.1 through 18.1.3 GitLab CE/EE versions 18.2 through 18.2.1 Description: The issue allows authenticated users with specific roles and permissions to delete issues, including...

PT-2025-33274

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 5.0.0 Description: Apache Superset contains an improper access control issue in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do...

CVE-2024-48892

A relative path traversal vulnerability CWE-23 in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacker to read arbitrary files via uploading a malicious solution pack...