EUVD-2026-64645

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

PT-2026-79764

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

EUVD-2026-62469

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

VulnCheck KEV: CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

BIT-GITLAB-2026-7427 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation...

FreeBSD : Gitlab -- Vulnerabilities (3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3 advisory. Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site...

ROS-20260818-73-0010

The vulnerability in portainer-ce is related to the tracking of symbolic links. Exploiting this vulnerability can allow an attacker to increase their privileges...

GHSA-2M8V-J782-FHVR vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-69185 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

EUVD-2026-60371

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

CVE-2026-19650

In GitLab CE/EE, improper request validation in GraphQL multiplex query handling allowed an unauthenticated user to execute mutations via GET requests. Affected versions are 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. CVSS 3.1 scores 7.1 (HIGH), with high...

CVE-2026-19478

GitLab CE/EE (self-managed) versions 18.2 through 19.2.3 are affected by a critical unauthenticated arbitrary method invocation vulnerability (CVSS 9.4, CWE-94) in the GraphQL API. The root cause is in the @gl_introduced directive's fallback field resolver (future_field_fallback.rb), which calls ...

PT-2026-76769

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.2 through 18.11.10 GitLab CE/EE versions 19.0 through 19.0.7 GitLab CE/EE versions 19.1 through 19.1.5 GitLab CE/EE versions 19.2 through 19.2.3 Description Improper request validation in GraphQL multiplex query handli...

Gitlab -- Vulnerabilities

Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE...

GO-2024-2576 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce...

GO-2026-5024 vulnerabilities

Vulnerabilities for packages: k3s, kube-conformance, gitlab-rails-ce, gitlab-rails-ce-fips, trino, upwind-agent, etcd-fips, kubeflow-katib, etcd...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: opencost-fips, flux-operator-fips, osv-scanner, glab, jaeger-fips, ferretdb, datadog-agent, gitlab-workhorse-ce, gitlab-workhorse-ce-fips, jaeger, opencost, flux-operator, livekit-cli, datadog-agent-fips...

GO-2025-4116 vulnerabilities

Vulnerabilities for packages: falco-no-driver, k3s, backup-restore-operator, gitlab-rails-ce, cert-manager-fips, gitlab-rails-ce-fips, vault, consul-k8s, rke2-runtime-fips, etcd-fips, etcd, terraform...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: kots, portieris-fips, gitlab-rails-ce, gitlab-rails-ce-fips, zot, envoy-gateway-fips, argocd-image-updater-fips, portieris, gitness, envoy-gateway, argocd-image-updater...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: kots, portieris-fips, gitlab-rails-ce, gitlab-rails-ce-fips, zot, envoy-gateway-fips, argocd-image-updater-fips, portieris, gitness, envoy-gateway, argocd-image-updater...