CVEs published by GitLab Inc.

CVEs published by GitLab Inc. (CVE Numbering Authority). 43 tracked.

• CVE-2026-5208 HIGH 8.2 UPGRADE Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute a
• CVE-2026-76886 HIGH 8.1 UPGRADE C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
• CVE-2026-5302 MEDIUM 6.3 UPGRADE CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers to read d
• CVE-2026-5301 HIGH 7.6 UPGRADE Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers to take ove
• CVE-2026-5300 MEDIUM 5.9 UPGRADE Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view
• CVE-2026-18258 HIGH 8.8 UPGRADE Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scrip
• CVE-2026-18359 HIGH 8.5 UPGRADE Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 a
• CVE-2026-18277 HIGH 7.1 UPGRADE Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 all
• CVE-2026-18275 MEDIUM 6.5 UPGRADE Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.
• CVE-2026-18276 MEDIUM 4.3 UPGRADE Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authen
• CVE-2026-13716 CRITICAL 9.1 UPGRADE Path traversal in server import and admin file upload in Crafty Controller
• CVE-2026-19696 MEDIUM 6.6 UPGRADE Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Wi
• CVE-2026-19694 MEDIUM 4.7 UPGRADE TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service
• CVE-2026-19695 MEDIUM 4.7 UPGRADE Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service
• CVE-2026-15723 HIGH 8.2 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.
• CVE-2026-12664 MEDIUM 6.8 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.
• CVE-2026-110264 CRITICAL 10.0 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0
• CVE-2026-102486 HIGH 7.5 Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker
• CVE-2026-102483 HIGH 7.5 Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS
• CVE-2026-114489 HIGH 8.1 Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6
• CVE-2026-114476 HIGH 7.5 Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 al
• CVE-2026-114479 MEDIUM 5.8 Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 thro
• CVE-2026-114478 MEDIUM 5.9 Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 thro
• CVE-2026-114490 HIGH 7.8 Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 all
• CVE-2026-112212 HIGH 7.5 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.
• CVE-2026-102484 MEDIUM 6.4 Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who contr
• CVE-2026-114474 MEDIUM 5.9 Use of a less trusted source for the envelope sender in the external-account download of Progressive Robot hMa
• CVE-2026-114475 MEDIUM 6.5 Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6
• CVE-2026-16255 MEDIUM 5.9 GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3
• CVE-2026-102485 MEDIUM 5.2 Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who c
• CVE-2026-114472 LOW 3.7 Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hMailServer 6.0.0 thro
• CVE-2026-114473 MEDIUM 5.0 Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.
• CVE-2026-114470 MEDIUM 5.3 Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remot
• CVE-2026-105777 MEDIUM 4.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 1
• CVE-2026-114477 MEDIUM 4.3 Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a
• CVE-2026-13319 MEDIUM 4.3 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19
• CVE-2026-114471 MEDIUM 4.7 Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 t
• CVE-2026-112378 MEDIUM 4.3 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3
• CVE-2026-105711 LOW 3.5 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.
• CVE-2026-14288 LOW 3.1 GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3
• CVE-2026-103515 LOW 2.7 GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3
• CVE-2026-112326 LOW 3.1 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3
• CVE-2026-85706 CRITICAL 10.0 EXPLOITED UPGRADE GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

← Back to latest CVEs