CVE-2026-111065 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

CVE-2026-111748 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

GHSA-F9XW-JH8M-3MWQ vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

CVE-2026-111066 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

CVE-2026-111750 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

GHSA-9XW5-W5JJ-PVCG vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

CVE-2026-111749 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

GHSA-PQXQ-W44R-73XW vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

GHSA-6CJC-53GC-5RQM vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

GHSA-GX76-C99X-2C96 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee-fips, commercial-gitlab-cng-ee, kserve, nemo-skills, py3.13-scanner-test-libraries-aiohttp, metaflow-service, litellm-fips...

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update...

GitLab input validation error vulnerability

A input validation error vulnerability exists in GitLab CE/EE versions from 18.3 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from improper trust of user-supplied values when constructing endpoint URLs within...

GitLab authorization issue vulnerability

GitLab EE versions prior to 12.0 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an authorization issue vulnerability. This vulnerability arises because, after enabling instance-level SAML or LDAP member locking, the system fails to fully enforce the member locking restrictio...

GitLab improper exception handling vulnerability

A security vulnerability exists in GitLab EE versions from 17.8 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from improper cleanup logic during error handling; it fails to distinguish between existing records...

GitLab information disclosure vulnerability

GitLab CE/EE versions prior to 15.0 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an information disclosure vulnerability. This vulnerability arises from an error in caching fragment keys that are unrelated to viewers; it results in user-anonymized rendered content being...

GitLab authorization issue vulnerability

A security vulnerability exists in GitLab CE/EE versions from 18.2 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from insufficient execution of GraphQL field scopes, allowing authenticated users with a readapi...

GitLab input validation error vulnerability

GitLab CE/EE versions prior to 10.1 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an input validation error vulnerability. This vulnerability stems from improper input sanitization during LDAP email lookup in the OmniAuth identity link process. When both OmniAuth SAML and...

CVE-2026-111759 vulnerabilities

Vulnerabilities for packages: renovate, gitlab-rails-ce, kibana, vitess, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

GHSA-R7FV-28H4-CVQ7 vulnerabilities

Vulnerabilities for packages: renovate, gitlab-rails-ce, kibana, vitess, gitlab-rails-ce-fips, commercial-gitlab-rails-ee-fips...

GitLab 19.2 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-103515)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo...