Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

13 records

Release: GitLab 18.6.6, 18.7.4, 18.8.4 Clear all filters
TI-2025-06992 CVE-2025-7659 · GHSA-7p7x-r7pv-gq7p

Origin Validation Error in GitLab

Priority MEDIUM 41

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to steal tokens and access private…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00222 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-346
TI-2025-07409 CVE-2025-8099 · GHSA-p7j7-2wwv-p5hw

Allocation of Resources Without Limits or Throttling in GitLab

Priority LOW 39

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an unauthenticated user to caus…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00476 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-770
TI-2025-11070 CVE-2025-12073 · GHSA-hfx3-365h-vfrv

Server-Side Request Forgery (SSRF) in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an authenticated user to perfor…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00271 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-918
TI-2025-11530 CVE-2025-12575 · GHSA-mqfv-j8mc-8hp5

Server-Side Request Forgery (SSRF) in GitLab

Priority LOW 24

GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user with certain…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00233 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-918
TI-2025-13302 CVE-2025-14560 · GHSA-gvr9-jwjx-g2pq

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Priority LOW 34

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00265 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-79
TI-2025-13335 CVE-2025-14594 · GHSA-3c27-7487-m6fw

Authorization Bypass Through User-Controlled Key in GitLab

Priority LOW 16

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to view c…

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00199 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-639
TI-2025-13333 CVE-2025-14592 · GHSA-xfh9-f34g-8fm7

Missing Authorization in GitLab

Priority LOW 24

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00305 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-862
TI-2026-00396 CVE-2026-0595 · GHSA-cf2v-m456-7qjf

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Priority LOW 34

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add una…

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00264 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-79
TI-2026-00724 CVE-2026-0958 · GHSA-9fx3-39vw-q4x9

Interpretation Conflict in GitLab

Priority LOW 39

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-436
TI-2026-00811 CVE-2026-1080 · GHSA-x398-2rgf-67p8

Authorization Bypass Through User-Controlled Key in GitLab

Priority MEDIUM 53

GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access ite…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00284 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-639
TI-2026-00998 CVE-2026-1282 · GHSA-8f2f-6w9m-mg42

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

Priority MEDIUM 58

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to inject malicious content into pro…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00198 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-80
TI-2026-01086 CVE-2026-1387 · GHSA-7x5p-82gv-c93r

Allocation of Resources Without Limits or Throttling in GitLab

Priority MEDIUM 62

GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00346 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-770
TI-2026-01155 CVE-2026-1458 · GHSA-m668-xfwp-34x6

Allocation of Resources Without Limits or Throttling in GitLab

Priority HIGH 66

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00433 Published 2026-02-11 Fixed in 18.6.6, 18.7.4 +1 CWE-770