Advisoriesby Ibis

AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GitLab security advisories

86 advisories · 34 critical or high in 12 months · latest Oct 22

Advisories page

60 of 86 advisories

Medium 6.8Oct 22

GitLab: improper authorizationCVE-2026-12664fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: missing authorizationCVE-2026-13319fixed in 19.3.6 +2 Low 3.1Oct 22

GitLab: improper access controlCVE-2026-14288fixed in 19.3.6 +2 High 8.2Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1...CVE-2026-15723fixed in 19.3.6 +2 Medium 5.9Oct 22

GitLab: improper authorizationCVE-2026-16255fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: authenticated user could access paid AI features withoutCVE-2026-112378fixed in 19.3.6 +2 Low 2.7Oct 22

GitLab: improper authorizationCVE-2026-103515fixed in 19.3.6 +2 Low 3.5Oct 22

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0...CVE-2026-105711fixed in 19.3.6 +2 Medium 4.3Oct 22

GitLab: information disclosureCVE-2026-105777fixed in 19.3.6 +2 Critical 10.0Oct 22

GitLab: remote code executionCVE-2026-110264fixed in 18.11.13 +3 High 7.5Oct 22

GitLab: request smugglingCVE-2026-112212fixed in 19.3.6 +2 Low 3.1Oct 22

GitLab: authenticated user could permanently delete existingCVE-2026-112326fixed in 19.3.6 +2 Critical 10.0Oct 13

GitLab: remote code executionCVE-2026-97229fixed in 19.2.8 +2 Critical 9.9Oct 2

GitLab AI Gateway: template injectionCVE-2026-90970fixed in 19.2.4 +2 Medium 4.3Sep 29

GitLab: missing authorizationCVE-2026-8937fixed in 19.2.7 +2 High 8.7Sep 29

GitLab: cross-site scriptingCVE-2026-84739fixed in 19.2.7 +2 Low 3.7Sep 29

GitLab: improper authorizationCVE-2026-4523fixed in 19.2.7 +2 Medium 4.3Sep 29

GitLab: improper authorizationCVE-2026-10518fixed in 19.2.7 +2 Critical 9.9Sep 24

GitLab: code executionCVE-2026-89078fixed in 19.2.7 +2 High 7.7Sep 24

GitLab: missing authorizationCVE-2026-92470fixed in 19.2.7 +2 Medium 4.3Sep 24

GitLab: improper authorizationCVE-2026-92529fixed in 19.2.7 +2 Medium 4.3Sep 24

GitLab: authenticated user could spoof merge request authorshipCVE-2026-92530fixed in 19.2.7 +2 Low 3.1Sep 24

GitLab: race conditionCVE-2026-92628fixed in 19.2.7 +2 Medium 5.4Sep 24

GitLab: improper authorizationCVE-2026-92874fixed in 19.2.7 +2 Critical 9.9Sep 24

GitLab: code executionCVE-2026-93577fixed in 19.2.7 +2 Medium 4.4Sep 16

GitLab: improper access controlCVE-2026-86341fixed in 19.1.8 +2 Medium 4.3Sep 16

GitLab: improper authorizationCVE-2026-7514fixed in 19.1.8 +2 High 8.2Sep 16

GitLab: cross-site scriptingCVE-2026-78252fixed in 19.1.8 +2 High 8.5Sep 16

GitLab: improper authorizationCVE-2026-79708fixed in 19.1.8 +2 Medium 4.3Sep 16

GitLab: missing authorizationCVE-2026-8030fixed in 19.1.8 +2 High 7.5Sep 16

GitLab: denial of serviceCVE-2026-1168fixed in 19.1.8 +2 Medium 4.7Sep 16

GitLab: cross-site scriptingCVE-2026-19619fixed in 19.1.8 +2 Low 3.1Sep 16

GitLab: denial of serviceCVE-2026-3855fixed in 19.1.8 +2 High 7.5Sep 16

GitLab: denial of serviceCVE-2025-14871fixed in 19.1.8 +2 Medium 4.3Sep 16

GitLab: improper authorizationCVE-2026-16794fixed in 19.1.8 +2 Medium 6.4Sep 16

GitLab: race conditionCVE-2024-11222fixed in 19.1.8 +2 High 8.5Sep 15

GitLab: remote code executionCVE-2026-88765fixed in 19.1.8 +2 Medium 5.3Sep 15

GitLab: improper authorizationCVE-2026-82837fixed in 19.1.8 +2 Medium 5.4Sep 15

GitLab: missing authenticationCVE-2026-12910fixed in 19.1.8 +2 High 7.7Sep 15

GitLab: improper input validationCVE-2026-13210fixed in 19.1.8 +2 Critical 9.9Sep 12

GitLab: unsafe deserializationCVE-2026-87719fixed in 18.11.12 +3 Critical 10.0Sep 12

GitLab: missing authenticationCVE-2026-85706fixed in 18.11.12 +3 High 8.2Aug 27

GitLab AI Gateway: server-side request forgeryCVE-2026-75871fixed in 19.0.12 +2 High 8.2Aug 27

GitLab AI Gateway: server-side request forgeryCVE-2026-19889fixed in 19.0.12 +2 Low 3.5Aug 26

GitLab: improper authorizationCVE-2026-7487fixed in 19.1.7 +2 Medium 6.5Aug 26

GitLab: denial of serviceCVE-2026-77801fixed in 19.1.7 +2 Medium 5.5Aug 26

GitLab: improper authorizationCVE-2026-3035fixed in 19.1.7 +2 High 7.3Aug 26

GitLab: untrusted functionality includedCVE-2026-18252fixed in 19.1.7 +2 Medium 4.3Aug 26

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1...CVE-2026-15387fixed in 19.1.7 +2 Medium 6.5Aug 26

GitLab: denial of serviceCVE-2025-10903fixed in 19.1.7 +2 High 8.5Aug 23

GitLab: remote code executionCVE-2026-10053fixed in 19.0.6 +2 Critical 9.4Aug 17

GitLab: code injectionCVE-2026-19478fixed in 18.11.11 +3 High 7.1Aug 17

GitLab: cross-site request forgeryCVE-2026-19650fixed in 18.11.11 +3 Medium 4.3Aug 12

GitLab: missing authorizationCVE-2026-6821fixed in 19.0.6 +2 Medium 4.3Aug 12

GitLab: missing authorizationCVE-2026-4879fixed in 19.0.6 +2 High 8.5Aug 12

GitLab: improper authorizationCVE-2026-19228fixed in 19.1.4 +1 Medium 4.3Aug 12

GitLab: improper authorizationCVE-2026-18433fixed in 19.1.4 +1 High 7.1Aug 12

GitLab: missing authorizationCVE-2026-16494fixed in 19.1.4 +1 High 8.7Aug 12

GitLab: cross-site scriptingCVE-2026-15216fixed in 19.0.6 +2 High 8.7Aug 12

GitLab: cross-site scriptingCVE-2026-15217fixed in 19.0.6 +2

About GitLab

Security advisories GitLab publishes for its own products.

gitlab.com/gitlab-org/cves GitLab

GitLab elsewhere on Ibis: Quarterly · Paydays · Releases