Gitlab -- vulnerabilities

2026-04-23 · CVE-2026-4922, CVE-2026-5816, CVE-2026-5262, CVE-2025-0186, CVE-2026-1660, CVE-2025-6016, CVE-2025-3922, CVE-2026-6515, CVE-2026-5377, CVE-2026-3254, CVE-2025-9957 · VuXML entry

Gitlab reports: Cross-Site Request Forgery issue in GraphQL API impacts GitLab CE/EE GitLab Improper Resolution of Path Equivalence issue in Web IDE asset impacts GitLab CE/EE Cross-site Scripting issue in Storybook impacts GitLab CE/EE Denial of Service issue in discussions endpoint impacts GitLab CE/EE Denial of Service issue in Jira import impacts GitLab CE/EE Denial of Service issue in notes endpoint impacts …

Affected versions

• gitlab-ce, gitlab-ee >= 18.11.0 < 18.11.1; >= 18.10.0 < 18.10.4; >= 9.2.0 < 18.9.6

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.