Gitlab -- vulnerabilities

2026-05-14 · CVE-2026-7481, CVE-2026-5297, CVE-2026-6073, CVE-2026-7377, CVE-2026-1659, CVE-2025-14870, CVE-2025-14869, CVE-2026-1322, CVE-2026-1184, CVE-2026-4524, CVE-2026-8280, CVE-2026-4527, CVE-2026-3160, CVE-2026-6335, CVE-2025-12669, CVE-2026-3607, CVE-2026-3074, CVE-2026-1338, CVE-2026-8144, CVE-2026-6063, CVE-2026-3073, CVE-2025-13874, CVE-2026-7471, CVE-2026-2900, CVE-2026-6883 · VuXML entry

Gitlab reports: Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE Cross-site Scripting issue in global search impacts GitLab CE/EE Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE Denial of Service issue in CI/CD job update API impacts GitLab CE/EE Denial of Service issue in Duo Workflows …

Affected versions

• gitlab-ce, gitlab-ee >= 18.11.0 < 18.11.3; >= 18.10.0 < 18.10.6; >= 8.3.0 < 18.9.7

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.