Security feed

25 October 2026

advisoryHighOfficial CVE List25 Oct 2026

Incorrect Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

Announced 9 Nov 2023

GitLab CVE-2023-4379

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2023-4379

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-4379
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #16601 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 01:19:33 GMT
Publisher date: Thu, 09 Nov 2023 21:01:10 GMT

Read the original announcement

advisoryMediumOfficial CVE List25 Oct 2026

Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.

Announced 7 Oct 2026

GitLab CVE-2026-1403

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-1403

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-1403
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #12272 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:05:02 GMT
Publisher date: Wed, 07 Oct 2026 20:05:40 GMT

Read the original announcement

24 October 2026

advisoryMediumKnown exploited CVEOfficial CVE List24 Oct 2026

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

Announced 11 Jun 2021

GitLab CVE-2021-22175

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2021-22175

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-22175
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2021-22175 · Unrated

GitLab · Known exploited (CISA KEV)

Event: #5748 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:13:28 GMT
Publisher date: Fri, 11 Jun 2021 15:30:12 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.

Announced 29 Sept 2026

GitLab CVE-2026-8937

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-8937

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-8937
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #3782 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:42 GMT
Publisher date: Tue, 29 Sep 2026 09:35:33 GMT

Read the original announcement

advisoryLowOfficial CVE List24 Oct 2026

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper authorization enforcement in the GraphQL API.

Announced 29 Sept 2026

GitLab CVE-2026-4523

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-4523

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-4523
Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event: #3775 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:37 GMT
Publisher date: Tue, 29 Sep 2026 09:35:38 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized to access due to improper authorization enforcement.

Announced 29 Sept 2026

GitLab CVE-2026-10518

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-10518

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-10518
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #3774 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:37 GMT
Publisher date: Tue, 29 Sep 2026 09:35:28 GMT

Read the original announcement

advisoryHighOfficial CVE List24 Oct 2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

Announced 29 Sept 2026

GitLab CVE-2026-84739

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-84739

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-84739
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #3492 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:07 GMT
Publisher date: Tue, 29 Sep 2026 09:34:28 GMT

Read the original announcement

advisoryCriticalOfficial CVE List24 Oct 2026

Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.

Announced 23 Sept 2026

GitLab CVE-2026-93577

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-93577

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-93577
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #1992 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:11:09 GMT
Publisher date: Wed, 23 Sep 2026 23:04:45 GMT

Read the original announcement

advisoryCriticalOfficial CVE List24 Oct 2026

Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Announced 23 Sept 2026

GitLab CVE-2026-89078

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-89078

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-89078
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #1991 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:11:08 GMT
Publisher date: Wed, 23 Sep 2026 23:05:20 GMT

Read the original announcement

advisoryHighOfficial CVE List24 Oct 2026

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

Announced 23 Sept 2026

GitLab CVE-2026-92470

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92470

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92470
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #1680 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:05:52 GMT
Publisher date: Wed, 23 Sep 2026 23:05:10 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

Use of Less Trusted Source in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports.

Announced 23 Sept 2026

GitLab CVE-2026-92530

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92530

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92530
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #611 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:48:03 GMT
Publisher date: Wed, 23 Sep 2026 23:05:15 GMT

Read the original announcement

advisoryLowOfficial CVE List24 Oct 2026

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.

Announced 23 Sept 2026

GitLab CVE-2026-92628

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92628

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92628
Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event: #592 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:51 GMT
Publisher date: Wed, 23 Sep 2026 23:04:50 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks.

Announced 23 Sept 2026

GitLab CVE-2026-92874

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92874

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92874
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #591 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:50 GMT
Publisher date: Wed, 23 Sep 2026 23:04:55 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks.

Announced 23 Sept 2026

GitLab CVE-2026-92529

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-92529

GitLab

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-92529
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #581 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:47:44 GMT
Publisher date: Wed, 23 Sep 2026 23:05:00 GMT

Read the original announcement