GCVE - cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:community:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:community:*:*:*

part: a version: 18.4.0 update: *

Vendor	Gitlab (`57573e99-56e6-5fad-895e-0ce7fffc5b90`)
Product	Gitlab (`5414fcda-a172-5f72-b6e4-b415a19d21eb`)
Edition	*
Language	*
Software edition	community
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gitlab/gitlab-org/gitlab`	purl2cpe	2026-06-01 10:14:46.352449

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9958`	vulnerable	2026-06-08 07:47:10.357683	Insertion of Sensitive Information Into Sent Data in GitLab HIGH (7.7) An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations. Published: 2025-09-26T09:04:41.537Z Updated: 2025-11-06T17:30:27.285Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/567777 https://hackerone.com/reports/3323573	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9642`	vulnerable	2026-06-08 07:47:09.442307	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab HIGH (8.7) An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover. Published: 2025-09-26T09:04:51.532Z Updated: 2025-09-26T13:15:17.950Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/566505 https://hackerone.com/reports/3297413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-8014`	vulnerable	2026-06-08 07:45:18.671295	Allocation of Resources Without Limits or Throttling in GitLab HIGH (7.5) Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption. Published: 2025-09-27T16:33:32.601Z Updated: 2025-09-30T17:27:13.696Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/556838 https://hackerone.com/reports/3228134	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-7691`	vulnerable	2026-06-08 07:45:17.974159	Privilege Defined With Unsafe Actions in GitLab MEDIUM (6.5) A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities. Published: 2025-09-26T09:05:06.532Z Updated: 2026-02-26T17:47:53.973Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/555786 https://hackerone.com/reports/3200469	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5069`	vulnerable	2026-06-08 07:35:24.090884	Incorrect Ownership Assignment in GitLab LOW (3.5) An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project. Published: 2025-09-26T09:11:09.636Z Updated: 2025-09-26T13:12:27.389Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/544926 https://hackerone.com/reports/3019236	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-11042`	vulnerable	2026-06-08 07:02:27.968134	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10871`	vulnerable	2026-06-08 07:02:27.646973	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10868`	vulnerable	2026-06-08 07:02:27.641059	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10867`	vulnerable	2026-06-08 07:02:27.640604	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10858`	vulnerable	2026-06-08 07:02:27.635260	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.