CVE-2026-19619

CVE-2026-19619 affects GitLab CE/EE versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability is a cross-site scripting (XSS) flaw caused by improper sanitization of pasted HTML content in the Content Editor . Under certain conditions, an unauthenticated attacker ...

EUVD-2026-80222

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-78252 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

EUVD-2026-80221

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-79708

CVE-2026-79708 is an incorrect authorization flaw in GitLab EE affecting versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Due to insufficient scope validation , an authenticated user with developer permissions could execute a policy test pipeline on projects within their g...

CVE-2026-79708 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

PT-2026-93330

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where improper validation of group URL slugs during namespace transfers could allow an...

CVE-2026-1168: Allocation of Resources Without Limits or Throttling

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL...

CVE-2026-86341: Access Control Check Implemented After Asset is Accessed

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval...

CVE-2026-79708: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their grou...

CVE-2026-16794: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

PT-2026-93319

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.4.6 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where an unauthenticated user can cause a denial of service. This occurs due to imprope...

PT-2026-93361

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.1 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user with Owner or Maintainer permissions can silently disable protected...

PT-2026-93322

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.11 through 19.1.7 GitLab EE versions 19.2 through 19.2.5 GitLab EE versions 19.3 through 19.3.1 Description Improper authorization controls on compliance framework management allow an authenticated user with the Security...

PT-2026-93320

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.4.6 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where an unauthenticated user can cause a denial of service. This occurs due to imprope...

PT-2026-93323

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description Improper sanitization of pasted HTML content in the Content Editor could allow an unauthenticated user to...

GitLab 17.1 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-86341)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner ...

GitLab 10.1.0 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-82837)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated...