GHSA-9XW5-W5JJ-PVCG vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

GHSA-GX76-C99X-2C96 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

GHSA-6CJC-53GC-5RQM vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

CVE-2026-111748 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

GHSA-PQXQ-W44R-73XW vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

CVE-2026-111749 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

CVE-2026-111750 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

GHSA-F9XW-JH8M-3MWQ vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

CVE-2026-111065 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-cng-ee, kserve, litellm-fips, commercial-gitlab-cng-ee-fips, py3.13-scanner-test-libraries-aiohttp, metaflow-service, nemo-skills...

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update...

GitLab authorization issue vulnerability

GitLab EE versions prior to 12.0 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an authorization issue vulnerability. This vulnerability arises because, after enabling instance-level SAML or LDAP member locking, the system fails to fully enforce the member locking restrictio...

GitLab input validation error vulnerability

A input validation error vulnerability exists in GitLab CE/EE versions from 18.3 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from improper trust of user-supplied values when constructing endpoint URLs within...

GitLab improper exception handling vulnerability

A security vulnerability exists in GitLab EE versions from 17.8 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from improper cleanup logic during error handling; it fails to distinguish between existing records...

GitLab information disclosure vulnerability

GitLab CE/EE versions prior to 15.0 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an information disclosure vulnerability. This vulnerability arises from an error in caching fragment keys that are unrelated to viewers; it results in user-anonymized rendered content being...

GitLab input validation error vulnerability

GitLab CE/EE versions prior to 10.1 through 19.3.6, 19.4 through 19.4.3, and 19.5 through 19.5.1 contain an input validation error vulnerability. This vulnerability stems from improper input sanitization during LDAP email lookup in the OmniAuth identity link process. When both OmniAuth SAML and...

GitLab authorization issue vulnerability

A security vulnerability exists in GitLab CE/EE versions from 18.2 up to and including 19.3.6, from 19.4 up to and including 19.4.3, and from 19.5 up to and including 19.5.1. This vulnerability stems from insufficient execution of GraphQL field scopes, allowing authenticated users with a readapi...

GHSA-R7FV-28H4-CVQ7 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, kibana, gitlab-rails-ce-fips, renovate, vitess, gitlab-rails-ce...

CVE-2026-111759 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee-fips, kibana, gitlab-rails-ce-fips, renovate, vitess, gitlab-rails-ce...

PT-2026-122472

Уязвимость программной платформы на базе git для совместной работы над кодом GitLab связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

PT-2026-120882

Name of the Vulnerable Software and Affected Versions GitLab EE versions 17.8 through 19.3.5 GitLab EE versions 19.4 through 19.4.2 GitLab EE versions 19.5 Description An issue exists where an authenticated user with read-only permissions can permanently delete existing vulnerability records. Thi...