GCVE - cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:enterprise:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:enterprise:*:*:*

part: a version: 18.4.0 update: *

Vendor	Gitlab (`57573e99-56e6-5fad-895e-0ce7fffc5b90`)
Product	Gitlab (`5414fcda-a172-5f72-b6e4-b415a19d21eb`)
Edition	*
Language	*
Software edition	enterprise
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gitlab/gitlab-org/gitlab`	purl2cpe	2026-06-01 10:14:46.352450

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9958`	vulnerable	2026-06-08 07:47:10.357791	Insertion of Sensitive Information Into Sent Data in GitLab HIGH (7.7) An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations. Published: 2025-09-26T09:04:41.537Z Updated: 2025-11-06T17:30:27.285Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/567777 https://hackerone.com/reports/3323573	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9642`	vulnerable	2026-06-08 07:47:09.443974	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab HIGH (8.7) An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject malicious content that may lead to account takeover. Published: 2025-09-26T09:04:51.532Z Updated: 2025-09-26T13:15:17.950Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/566505 https://hackerone.com/reports/3297413	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-8014`	vulnerable	2026-06-08 07:45:18.671403	Allocation of Resources Without Limits or Throttling in GitLab HIGH (7.5) Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption. Published: 2025-09-27T16:33:32.601Z Updated: 2025-09-30T17:27:13.696Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/556838 https://hackerone.com/reports/3228134	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-7691`	vulnerable	2026-06-08 07:45:17.975276	Privilege Defined With Unsafe Actions in GitLab MEDIUM (6.5) A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities. Published: 2025-09-26T09:05:06.532Z Updated: 2026-02-26T17:47:53.973Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/555786 https://hackerone.com/reports/3200469	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5069`	vulnerable	2026-06-08 07:35:24.091712	Incorrect Ownership Assignment in GitLab LOW (3.5) An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project. Published: 2025-09-26T09:11:09.636Z Updated: 2025-09-26T13:12:27.389Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/544926 https://hackerone.com/reports/3019236	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-11042`	vulnerable	2026-06-08 07:02:27.968267	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10871`	vulnerable	2026-06-08 07:02:27.647073	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10868`	vulnerable	2026-06-08 07:02:27.641079	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10867`	vulnerable	2026-06-08 07:02:27.640626	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-10858`	vulnerable	2026-06-08 07:02:27.636369	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.