Gitlab -- vulnerabilities

2026-01-11 · CVE-2025-9222, CVE-2025-13761, CVE-2025-13772, CVE-2025-13781, CVE-2025-10569, CVE-2025-11246, CVE-2025-3950 · VuXML entry

Gitlab reports: Stored Cross-site Scripting issue in GitLab Flavored Markdown placeholders impacts GitLab CE/EE Cross-site Scripting issue in Web IDE impacts GitLab CE/EE Missing Authorization issue in Duo Workflows API impacts GitLab EE Missing Authorization issue in AI GraphQL mutation impacts GitLab EE Denial of Service issue in import functionality impacts GitLab CE/EE Insufficient Access Control Granularity …

Affected versions

• gitlab-ce, gitlab-ee >= 18.7.0 < 18.7.1; >= 18.6.0 < 18.6.3; >= 8.3.0 < 18.5.5

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.