22569 matches found
PT-2025-50572
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.10 through 18.4.5 GitLab CE/EE versions 18.5 through 18.5.3 GitLab CE/EE versions 18.6 through 18.6.1 Description An unauthenticated user could create a denial of service condition by sending crafted GraphQL queries th...
PT-2025-50574
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 6.3 through 18.4.5 GitLab CE/EE versions 18.5 through 18.5.3 GitLab CE/EE versions 18.6 through 18.6.1 Description An authenticated user could potentially cause a Denial of Service condition by sending specially crafted A...
BIT-GITLAB-2024-9183 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific...
CVE-2025-61727 vulnerabilities
Vulnerabilities for packages: git-sync-fips, kubernetes-csi-external-resizer-fips, crossplane-provider-sql-fips, kiali, task, aws-flb-firehose-fips, cert-manager-fips, chisel, crossplane-provider-terraform-fips, kargo, mongo-tools, protoc-gen-go, aws-flb-cloudwatch-fips, falco-exporter-fips,...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: git-sync-fips, kubernetes-csi-external-resizer-fips, crossplane-provider-sql-fips, kiali, task, aws-flb-firehose-fips, cert-manager-fips, chisel, crossplane-provider-terraform-fips, kargo, mongo-tools, protoc-gen-go, aws-flb-cloudwatch-fips, falco-exporter-fips,...
CVE-2025-66629
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...
CVE-2024-9183
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific...
CVE-2025-66629
HedgeDoc versions prior to 1.10.4 are affected by missing CSRF protection in OAuth2 endpoints for social logins (Google, GitHub, GitLab, Facebook, Dropbox) due to not sending/verifying a state parameter. This could allow attackers to hijack user authentication sessions. The issue is fixed in 1.10...
GHSA-475M-QJ5V-HVQ3 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-QRCV-45VG-JFWM vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-2H39-HW8G-2Q24 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-V9H3-MQGC-W575 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-JC72-5MCM-WV54 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-4J42-WQ8Q-C389 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-MWVC-FHMM-47CQ vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-66CV-679X-3FFV vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-H7PC-V4HV-WJWM vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
GHSA-6V4W-CQRG-XV3G vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...