Gitlab -- vulnerabilities

2025-12-11 · CVE-2025-12716, CVE-2025-8405, CVE-2025-12029, CVE-2025-12562, CVE-2025-11984, CVE-2025-4097, CVE-2025-14157, CVE-2025-11247, CVE-2025-13978, CVE-2025-12734 · VuXML entry

Gitlab reports: Cross-site scripting issue in Wiki impacts GitLab CE/EE Improper encoding in vulnerability reports impacts GitLab CE/EE Cross-site scripting issue in Swagger UI impacts GitLab CE/EE Denial of service issue in GraphQL endpoints impacts GitLab CE/EE Authentication bypass issue for WebAuthn users impacts GitLab CE/EE Denial of service issue in ExifTool processing impacts GitLab CE/EE Denial of service …

Affected versions

• gitlab-ce, gitlab-ee >= 18.6.0 < 18.6.2; >= 18.5.0 < 18.5.4; >= 6.3.0 < 18.4.6

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.