CVE-2025-10903

GitLab EE is affected by an unbounded loop (infinite loop) in the SCIM user provisioning feature , allowing an authenticated user to trigger a denial of service via specially crafted input. The vulnerability affects all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1...

EUVD-2026-66431

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035

GitLab EE is affected by an improper authorization check that allows an authenticated user with project Maintainer permissions to access the terminal of a protected environment they are not authorized to use, under certain conditions. The vulnerability affects versions from 11.3 before 19.1.7, 19...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-7487 Access Control Check Implemented After Asset is Accessed in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

EUVD-2026-66430

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules du...

CVE-2026-7487

GitLab EE is affected by an improper authorization check where the access control check is implemented after the asset is accessed . An authenticated user with reporter-role permissions who authored a merge request could reset merge request approval rules under certain conditions. The vulnerabili...

CVE-2026-15387

GitLab EE is affected by an acceptance of extraneous untrusted data with trusted data issue in versions 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 . The root cause is improper handling of job dependencies , which allows an authenticated user with developer-role permissions to ...

EUVD-2026-66429

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy...

CVE-2026-15387 Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy...

EUVD-2026-66428

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

CVE-2026-18252 Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude...

CVE-2026-18252

GitLab EE (versions 18.9 through 19.3) is affected by a vulnerability where the Claude agent processes configuration from a user-controlled source, allowing an authenticated user with developer-role permissions to execute arbitrary commands in a CI context. The root cause is the inclusion of func...

CVE-2026-77801 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

CVE-2026-77801

GitLab CE/EE versions from 12.8 before 19.1.7 , 19.2 before 19.2.5 , and 19.3 before 19.3.1 are affected by an Allocation of Resources Without Limits or Throttling issue. The root cause is missing object count limits in background job processing , which under certain conditions could allow an aut...

EUVD-2026-66427

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing objec...

LeitWacht Agent

leitwacht-agent https://leitwacht.eu — fonte di verità: https://gitlab.com/leitwacht/leitwacht-agent. Issue, MR e discussioni risiedono su GitLab. Pre-1.0. La serie 0.x è pre-stabile; le release minori possono introdurre modifiche sostanziali a API, nomi di variabili d'ambiente, chiavi di...

LeitWacht

GitLab Runner Leitwacht Applicazione dell'egress di rete per i container CI/CD di GitLab Runner. Leitwacht previene gli attacchi alla supply chain impedendo l'esfiltrazione di segreti, controllando a cosa ogni container job può accedere sulla rete. Come Funziona Leitwacht è un agente standalone c...

gitlab-cve-2021-22205

gitlab-cve-2021-22205 Ein einfaches Bash-Skript, das CVE-2021-22205 gegen verwundbare GitLab-Instanzen ausnutzt. Verwendung root@kitploit: Usage: cve-2021-22205.sh options Options: -h,--help Show this help -t,--target Set the target server i.e. "http://gitlab.example.com" -i,--reverse-ip Set the ...

CVE-2022-2992

CVE-2022-2992 Esecuzione remota di comandi autenticata in GitLab tramite importazione da GitHub. Una vulnerabilità in GitLab CE/EE che interessa tutte le versioni dalla 11.10 precedenti alla 15.1.6, tutte le versioni a partire dalla 15.2 precedenti alla 15.2.4, tutte le versioni a partire dalla...