CVE-2025-12506: Use of Incorrectly-Resolved Name or Reference

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interface differed from t...

CVE-2026-8472: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with minimal access permissions to read work item metadata from private projects due to...

CVE-2026-6352: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with auditor-level access to modify compliance violation records due to improper...

CVE-2026-13320: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper...

PT-2026-56587

Name of the Vulnerable Software and Affected Versions GitLab EE versions 9.5 through 18.11.6 GitLab EE versions 19.0 through 19.0.3 GitLab EE versions 19.1 through 19.1.1 Description Improper authorization controls could allow an authenticated user with maintainer-role permissions to obtain the...

PT-2026-56614

Name of the Vulnerable Software and Affected Versions GitLab EE versions 18.2 through 18.11.6 GitLab EE versions 19.0 through 19.0.3 GitLab EE versions 19.1 through 19.1.1 Description An improper authorization issue exists in certain GraphQL operations that could allow an authenticated user with...

BBOT's gitlab.py exposes globally configured "gitlab" API key

Summarybbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances.If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server. ImpactA user with a "gitlab" API key configured who uses bbot to scan a malicious webserv...

PYSEC-2026-1217 BBOT's gitlab.py exposes globally configured "gitlab" API key

Summary bbot's gitlab.py sends the user's "gitlab" API key to on-premise GitLab instances. If a user has configured a gitlab.com API key using this mechanism, it may be leaked to an attacker-controlled server. Impact A user with a "gitlab" API key configured who uses bbot to scan a malicious...

PYSEC-2026-1216 BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver

Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...

GHSA-Q675-QJ96-32M9 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-rocksdb-fips, seaweedfs-operator, gitlab-workhorse-ce, seaweedfs-fips, mattermost-fips, seaweedfs-rocksdb, seaweedfs...

GHSA-V62P-RQ8G-8H59 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2025-6545 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GHSA-H7CP-R72F-JXH6 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

CVE-2025-6547 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-rails-ce-fips...

GitLab Privilege Escalation

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

GitLab Reverse DNS Unauthorized Access

The vulnerability of the software interface of the CI/CD subsystem of the Git-based software platform for collaborative code development on GitLab EE/CE is related to the dependence of critical operations on the reverse DNS solution. Exploiting this vulnerability can allow a malicious actor to ga...

GitLab EE Unauthorized Access

The vulnerability of the software interface of a Git-based software platform for collaborative code development on GitLab EE is related to the bypassing of authentication using a key controlled by the user. Exploiting this vulnerability can allow an intruder, operating remotely, to gain...

GitLab CI/CD Unauthorized Access

The vulnerability of the software interface of the CI/CD subsystem of the Git-based software platform for collaborative code development in GitLab EE/CE is related to insufficient protection of registration data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

Maven Package Registry Bypass

The vulnerability of the Maven package registry on the Git-based software development platform, used for collaborative code development on GitLab EE/CE, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass existing securit...

GitLab EE Code Execution

The vulnerability of the programming platform’s analytics panel based on Git for collaborative code development in GitLab EE is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...