Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

10 records

Release: GitLab 18.4.6, 18.5.4, 18.6.2 Clear all filters
TI-2025-11028 CVE-2025-12029 · GHSA-2jwx-73fx-pwrv

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Priority LOW 37

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to…

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00527 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-79
TI-2025-11670 CVE-2025-12734 · GHSA-cpx5-2q84-prc5

Improper Encoding or Escaping of Output in GitLab

Priority LOW 16

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to, under certain conditions, render…

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00269 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-116
TI-2025-03637 CVE-2025-4097 · GHSA-p9w7-rqj5-fjh5

Allocation of Resources Without Limits or Throttling in GitLab

Priority LOW 35

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condit…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00302 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-770
TI-2025-07691 CVE-2025-8405 · GHSA-fjj2-x466-w3hx

Improper Encoding or Escaping of Output in GitLab

Priority LOW 36

GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized acti…

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00515 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-116
TI-2025-10299 CVE-2025-11247 · GHSA-j9w8-4m8f-75m4

Authorization Bypass Through User-Controlled Key in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to disclose sensitive information from…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00238 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-639
TI-2025-10986 CVE-2025-11984 · GHSA-m766-xfqm-qm37

Authentication Bypass Using an Alternate Path or Channel in GitLab

Priority LOW 32

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to bypass WebAuthn two-factor authen…

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00391 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-288
TI-2025-11523 CVE-2025-12562 · GHSA-h2vc-rgmf-cp34

Allocation of Resources Without Limits or Throttling in GitLab

Priority MEDIUM 40

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service con…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00864 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-770
TI-2025-11658 CVE-2025-12716 · GHSA-6v2x-53rq-w964

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Priority MEDIUM 40

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform…

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00424 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-79
TI-2025-12773 CVE-2025-13978 · GHSA-mp63-3qcj-f8c7

Generation of Error Message Containing Sensitive Information in GitLab

Priority LOW 20

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to discover the names of private pro…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00302 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-209
TI-2025-12937 CVE-2025-14157 · GHSA-j8j9-23cp-fr5v

Allocation of Resources Without Limits or Throttling in GitLab

Priority LOW 29

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a Denial of Service conditio…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00314 Published 2025-12-11 Fixed in 18.4.6, 18.5.4 +1 CWE-770