GCVE - cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:enterprise:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gitlab:gitlab:18.10.0:*:*:*:enterprise:*:*:*

part: a version: 18.10.0 update: *

Vendor	Gitlab (`57573e99-56e6-5fad-895e-0ce7fffc5b90`)
Product	Gitlab (`5414fcda-a172-5f72-b6e4-b415a19d21eb`)
Edition	*
Language	*
Software edition	enterprise
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gitlab/gitlab-org/gitlab`	purl2cpe	2026-06-01 10:14:46.352373

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-4363`	vulnerable	2026-06-08 08:05:13.282074	Incorrect Authorization in GitLab LOW (3.7) GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions. Published: 2026-03-25T15:04:46.503Z Updated: 2026-03-25T19:57:37.853Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/work_items/578561 https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-3988`	vulnerable	2026-06-08 08:01:19.753343	Inefficient Algorithmic Complexity in GitLab HIGH (7.5) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing. Published: 2026-03-25T16:33:43.952Z Updated: 2026-03-25T17:21:53.191Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/work_items/593140 https://hackerone.com/reports/3597342 https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-3857`	vulnerable	2026-06-08 08:01:19.574963	Cross-Site Request Forgery (CSRF) in GitLab HIGH (8.1) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection. Published: 2026-03-25T16:33:53.854Z Updated: 2026-03-26T13:20:03.781Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/work_items/592828 https://hackerone.com/reports/3584382 https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2995`	vulnerable	2026-06-08 07:55:17.937442	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab HIGH (7.7) GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper sanitization of HTML content. Published: 2026-03-25T16:33:58.853Z Updated: 2026-03-26T13:20:13.378Z Open on db.gcve.eu Reference links https://hackerone.com/reports/3564600 https://gitlab.com/gitlab-org/gitlab/-/work_items/591065 https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2973`	vulnerable	2026-06-08 07:55:17.911679	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab MEDIUM (5.4) GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in Mermaid diagrams. Published: 2026-03-25T16:34:03.852Z Updated: 2026-03-26T17:24:32.440Z Open on db.gcve.eu Reference links https://hackerone.com/reports/3566802 https://gitlab.com/gitlab-org/gitlab/-/work_items/591049 https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2745`	vulnerable	2026-06-08 07:55:17.459463	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2726`	vulnerable	2026-06-08 07:55:17.434924	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2370`	vulnerable	2026-06-08 07:55:16.971283	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1724`	vulnerable	2026-06-08 07:49:09.475215	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-14595`	vulnerable	2026-06-08 07:06:34.811313	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-13436`	vulnerable	2026-06-08 07:04:32.189654	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-13078`	vulnerable	2026-06-08 07:04:31.532833	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.