| CVE-2026-92874 |
|
Medium |
Sep 24, 2026 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under ce
more...
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.0.10, v19.1.9, v18.11.13, v19.0.9, v18.11.12, v19.4.0, v19.1.8
|
| CVE-2026-9268 |
|
Medium |
Oct 13, 2026 |
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under cert
more...
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.0.10, v19.1.9, v18.11.13, v19.3.4, v19.2.7, v19.3.3, v19.4.1
|
| CVE-2026-92628 |
|
Low |
Sep 24, 2026 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a
more...
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.0.10, v19.1.9, v18.11.13, v19.0.9, v18.11.12, v19.4.0, v19.1.8
|
| CVE-2026-92528 |
|
Medium |
Oct 13, 2026 |
GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under cer
more...
GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.0.10, v19.1.9, v18.11.13, v19.3.4, v19.2.7, v19.3.3, v19.4.1
|
| CVE-2026-92470 |
|
High |
Sep 24, 2026 |
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certa
more...
GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.0.10, v19.1.9, v18.11.13, v19.0.9, v18.11.12, v19.4.0, v19.1.8
|
| CVE-2026-8937 |
|
Medium |
Sep 29, 2026 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under ce
more...
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they had no access to, due to missing authorization checks on linked work items within visible epics.
less...
|
v19.0.11, v19.1.10, v19.0.10, v19.1.9, v19.0.9, v19.4.0, v19.1.8, v19.2.6, v19.3.2, v19.1.7
|
| CVE-2026-88765 |
|
High |
Sep 15, 2026 |
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain condit
more...
GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.
less...
|
v19.0.11, v18.11.14, v19.0.10, v18.11.13, v19.0.9, v18.11.12, v19.1.7, v19.2.5, v19.3.1, v19.3.0
|
| CVE-2026-86341 |
|
Medium |
Sep 16, 2026 |
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under cert
more...
GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control checks performed after the protected resource was modified.
less...
|
v19.0.11, v18.11.14, v19.0.10, v18.11.13, v19.0.9, v18.11.12, v19.1.7, v19.2.5, v19.3.1, v19.3.0
|
| CVE-2026-84739 |
|
High |
Sep 29, 2026 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under c
more...
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.0.10, v19.1.9, v18.11.13, v19.0.9, v18.11.12, v19.4.0, v19.1.8
|
| CVE-2026-84284 |
|
Medium |
Oct 13, 2026 |
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under
more...
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.
less...
|
v19.0.11, v19.1.10, v18.11.14, v19.3.6, v19.0.10, v19.1.9, v18.11.13, v19.3.5, v19.3.4, v19.2.7
|
