Bitnami package
gitlab
pkg:bitnami/gitlab
Vulnerabilities (1,131)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-13320 | Hig | 7.3 | >= 15.7.0, < 18.11.7 | 18.11.7 | Jul 8, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to | |
| CVE-2026-13151 | — | >= 16.10.0, < 18.11.7 | 18.11.7 | Jul 8, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||
| CVE-2026-11827 | Med | 4.9 | >= 9.5.0, < 18.11.7 | 18.11.7 | Jul 8, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentia | |
| CVE-2025-12506 | Low | 3.5 | >= 16.5.0, < 18.11.7 | 18.11.7 | Jul 8, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interfac | |
| CVE-2026-8330 | Med | 4.4 | >= 9.3.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI | |
| CVE-2026-5952 | Med | 4.3 | >= 17.11.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules an | |
| CVE-2026-5796 | Med | 4.3 | >= 13.6.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from pr | |
| CVE-2026-5309 | Med | 5.4 | >= 18.6.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy setting | |
| CVE-2026-3176 | Low | 3.1 | >= 18.6.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficien | |
| CVE-2026-2238 | Med | 5.3 | >= 17.5.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to impr | |
| CVE-2026-1606 | Med | 4.3 | >= 14.8.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation. | |
| CVE-2026-12635 | Non | 0.0 | >= 8.3.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network r | |
| CVE-2026-12053 | Hig | 8.6 | >= 19.1.0, < 19.1.1 | 19.1.1 | Jun 25, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows. | |
| CVE-2026-11379 | Med | 5.3 | >= 13.11.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile s | |
| CVE-2026-10712 | Hig | 8.0 | >= 18.10.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to | |
| CVE-2026-10086 | Hig | 8.7 | >= 16.4.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in | |
| CVE-2026-0934 | Low | 3.8 | >= 17.9.0, < 18.11.6 | 18.11.6 | Jun 25, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environ | |
| CVE-2026-9694 | Low | 2.6 | >= 15.9.0, < 18.10.8 | 18.10.8 | Jun 11, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary conten | |
| CVE-2026-9204 | Med | 5.3 | >= 18.10.0, < 18.10.8 | 18.10.8 | Jun 11, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal | |
| CVE-2026-8589 | Hig | 7.3 | >= 13.1.4, < 18.10.8 | 18.10.8 | Jun 11, 2026 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due |
- affected >= 15.7.0, < 18.11.7fixed 18.11.7
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to
- CVE-2026-13151Jul 8, 2026affected >= 16.10.0, < 18.11.7fixed 18.11.7
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- affected >= 9.5.0, < 18.11.7fixed 18.11.7
GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to obtain another user's stored credentia
- affected >= 16.5.0, < 18.11.7fixed 18.11.7
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to create a repository where the content displayed in the web interfac
- affected >= 9.3.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed sensitive information to be written to application logs due to insufficient filtering in a CI
- affected >= 17.11.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass package protection rules an
- affected >= 13.6.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from pr
- affected >= 18.6.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy setting
- affected >= 18.6.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to access project information due to insufficien
- affected >= 17.5.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public projects due to impr
- affected >= 14.8.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation.
- affected >= 8.3.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network r
- affected >= 19.1.0, < 19.1.1fixed 19.1.1
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows.
- affected >= 13.11.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 prior to 18.11.6, 19.0 prior to 19.0.3, and 19.1 prior to 19.1.1 in which incorrect authorization in DAST site profile management could allow a user with Developer role to exfiltrate DAST site profile s
- affected >= 18.10.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to
- affected >= 16.4.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in
- affected >= 17.9.0, < 18.11.6fixed 18.11.6
GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environ
- affected >= 15.9.0, < 18.10.8fixed 18.10.8
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions, could have allowed an unauthenticated user to impersonate the GitLab Support Bot and inject arbitrary conten
- affected >= 18.10.0, < 18.10.8fixed 18.10.8
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal
- affected >= 13.1.4, < 18.10.8fixed 18.10.8
GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due
Page 3 of 57