CVE-2024-6783 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, commercial-gitlab-rails-ee-fips...

CVE-2024-9506 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, commercial-gitlab-rails-ee-fips...

GHSA-6FW5-9HQ8-W87G vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, commercial-gitlab-rails-ee, gitlab-rails-ce, commercial-gitlab-rails-ee-fips...

CVE-2026-104852 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, langfuse, gitlab-rails-ce-fips, langfuse-fips, gitlab-rails-ce...

GitLab Community Edition 13.10.1 Remote Command Execution

GitLab Community Edition version 13.10.1 allows unauthenticated remote command execution when a crafted image is processed by ExifTool's DjVu parser. https://packetstorm.news/download/235014...

Exploit for Code Injection in Gitlab

GitLab ExifTool RCE CVE-2021-22205 Vulhubhttps://vulhub...

CVE-2026-1403

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

GHSA-GXM5-99CW-XJW9 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, langfuse-fips, gitlab-rails-ce...

CVE-2026-74866 vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, gitlab-rails-ce-fips, langfuse-fips, gitlab-rails-ce...

CVE-2026-1403

GitLab CE/EE versions from 11.7 before 18.8.9 , 18.9 before 18.9.5 , and 18.10 before 18.10.3 are affected by a Denial of Service vulnerability. The root cause is improper validation of CSV file structure during the import process, which allows an authenticated user to cause a denial of service t...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

EUVD-2026-94613

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-1403

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via SCM scaffolder actions in bitbucketServer.ts and related action files, where the actions fall back to server-side integration credentials when no user-supplied token is provided. An authenticated attacker can...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-gitlab (>=0.0.0-nightly-20240929023448, <=0.11.3-next.2)

@backstage/plugin-scaffolder-backend-module-gitlab NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =4.3.2, =0.3.3, =0.3.4 and more Source...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-gitlab (>=0.0.0-nightly-20240929023448, <=0.11.3-next.2)

@backstage/plugin-scaffolder-backend-module-gitlab NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =4.3.2, =0.3.3, =0.3.4 and more Source...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-gitlab (>=0.0.0-nightly-20240929023448, <=0.11.3-next.2)

@backstage/plugin-scaffolder-backend-module-gitlab NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =4.3.2, =0.3.3, =0.3.4 and more Source...

@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)

@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: OSV:GHSA-GP6M-X9VW-5C5X...