Do Son GitLab fixes critical CVE-2025-7659 (CVSS 8.0). Unauthenticated attackers can steal tokens via Web IDE. Update to v18.8.4 now to secure your code.
gitlab
GitLab patches critical flaw CVE-2026-1868 (CVSS 9.9) in self-hosted AI Gateway. Vulnerability allows RCE via insecure templates. Update to v18.8.1 now.
GitLab patches high-severity 2FA bypass (CVE-2026-0723) & DoS flaws. Update to 18.8.2, 18.7.2, or 18.6.4 immediately to secure your instance.
GitLab patches critical Stored XSS (CVE-2025-9222) and AI flaws in versions 18.7.1, 18.6.3, & 18.5.5. Update immediately to secure your pipelines.
A High-severity XSS (CVSS 8.7) flaw in GitLab Wiki allows session hijack via malicious pages, enabling unauthorized actions. Other HTML Injection flaws patched. Self-managed admins must update to v18.6.2.
Critical GitLab updates (18.6.1/18.5.3) fix severe CI/CD credential theft (CVE-2024-9183) & unauthenticated DoS flaws. Upgrade immediately.
NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.
GitLab patched a High-severity Stored XSS flaw (CVE-2025-11224, CVSS 7.7) in the Kubernetes proxy feature. The bug allows authenticated users to hijack administrator sessions. Update to v18.5.2+.
GitLab patched a critical runner hijacking flaw (CVE-2025-11702) allowing authenticated users to compromise CI/CD pipelines, plus three unauthenticated DoS vulnerabilities.
GitLab patched two high-severity flaws: CVE-2025-11340 (Auth Bypass) allows API write access with read-only tokens, and CVE-2025-10004 permits unauthenticated DoS via GraphQL.
GitLab urges immediate upgrade to patch versions 18.4.1+ for high-severity DoS flaws that allowed unauthenticated attackers to crash self-managed instances.
GitLab Threat Intelligence reveals a new North Korean malware campaign using "ClickFix" social engineering to target new industries like crypto and retail.
GitLab has released emergency patches for multiple vulnerabilities, including two high-severity flaws that could lead to denial of service and server-side request forgery.
GitLab has released patches for multiple high-severity vulnerabilities, including several XSS flaws that could lead to account takeover. All users should update immediately.
GitLab researchers uncovered a crypto scam on PyPI. Typosquatted Bittensor packages hijacked staking functions to silently drain users' crypto wallets.
GitLab patched multiple high-severity XSS and data exposure vulnerabilities in CE/EE, urging users to update to 18.2.1, 18.1.3, or 18.0.5.
GitLab releases urgent security updates to fix critical vulnerabilities, including an 8.7 CVSS score XSS flaw. Update your instances now to prevent attacks.
GitLab issues urgent updates for high-severity flaws in CE/EE, including HTML injection (account takeover) and CI/CD code injection. Upgrade to 18.0.2, 17.11.4, or 17.10.8 immediately.
GitLab released urgent updates (18.0.1+) fixing high-severity flaws, including a DoS vulnerability (CVE-2025-0993) and a 2FA bypass (CVE-2024-12093).
GitLab releases critical security updates 17.11.1, 17.10.5, 17.9.7 to fix high-severity XSS, account takeover risks. Upgrade now to protect your GitLab instance.
Stay secure with updates on CVE-2025-2255 & CVE-2025-0811. GitLab users must upgrade to versions 17.10.1, 17.9.3, or 17.8.6.
Two of the most severe issues, tracked as CVE-2025-25291 and CVE-2025-25292, reside in the ruby-saml library, which GitLab uses for SAML SSO authentication