Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Release: GitLab 18.7.6, 18.8.6, 18.9.2 Clear all filters
TI-2025-11518 CVE-2025-12555 · GHSA-w927-ccxx-qvrj

Incorrect Authorization in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-863
TI-2025-11531 CVE-2025-12576 · GHSA-m62r-8f87-wrg8

Allocation of Resources Without Limits or Throttling in GitLab

Priority LOW 29

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that under certain conditions could have allowed an authenticated user to cause a d…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00447 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-770
TI-2025-11645 CVE-2025-12697 · GHSA-jqw6-r3pp-rfvr

Improper Encoding or Escaping of Output in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00341 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-116
TI-2025-11647 CVE-2025-12704 · GHSA-5prc-f4c3-qjpv

Missing Authorization in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in grou…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00303 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-862
TI-2025-12512 CVE-2025-13690 · GHSA-mgcq-rqq2-gc5f

Allocation of Resources Without Limits or Throttling in GitLab

Priority LOW 29

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condit…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00447 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-770
TI-2025-12730 CVE-2025-13929 · GHSA-6mr8-cjxv-868w

Allocation of Resources Without Limits or Throttling in GitLab

Priority MEDIUM 40

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by is…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00595 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-770
TI-2025-13256 CVE-2025-14513 · GHSA-wj4p-jhrc-wr8q

Improper Validation of Specified Quantity in Input in GitLab

Priority HIGH 72

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service cond…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-1284
TI-2026-00403 CVE-2026-0602 · GHSA-32m4-j55x-cqhg

Authentication Bypass Using an Alternate Path or Channel in GitLab

Priority MEDIUM 53

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private is…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00282 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-288
TI-2026-00821 CVE-2026-1090 · GHSA-qv6p-pfj5-mhj9

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Priority LOW 39

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` fe…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00275 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-79
TI-2026-00951 CVE-2026-1230 · GHSA-6hv2-5mwg-mjjf

Use of Incorrectly-Resolved Name or Reference in GitLab

Priority MEDIUM 62

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 1.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause repository downloads to cont…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00229 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-706
TI-2026-01347 CVE-2026-1663 · GHSA-2jv7-gvqw-mxm4

Missing Authorization in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with group import permissions to cre…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-862
TI-2026-01415 CVE-2026-1732 · GHSA-gcgf-w628-jq5c

Improper Removal of Sensitive Information Before Storage or Transfer in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose confidential issue title…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00296 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-212
TI-2026-03334 CVE-2026-3848 · GHSA-j592-x6jp-9fg8

Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab

Priority LOW 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests…

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00218 Published 2026-03-11 Fixed in 18.7.6, 18.8.6 +1 CWE-93