BugRater
Early access. This site has moved to bugrater.com.

Security releases

GitLab

GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8

patch-release-gitlab-19-3-2-released Sep 10, 2026 Source: Vendor

Imported by the GitLab patch release catcher from https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/. 18 CVE sections listed. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

16 lines
All 16 CVEs 16 Additional recognition 0 Unclaimed only
Showing 1–16 of 16
CVE-2026-85706 Known exploited (CISA KEV) BR2026-0000-012000 unclaimed
Path Traversal issue in repository commits API impacts GitLab CE/EE
Credited as s3ntago
CVE-2026-87719 BR2026-0000-012001 unclaimed
Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE
Credited as kyyblin
CVE-2026-88765 BR2026-0000-012002 unclaimed
Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE
Credited as joaxcar
CVE-2026-79708 BR2026-0000-012003 unclaimed
Scheduled Pipeline Execution Policy test allows Developers to access protected CI/CD variables
Credited as yvvdwf
CVE-2026-78252 BR2026-0000-012004 unclaimed
Cross-site Scripting issue in Markdown JSON table renderer impacts GitLab CE/EE
Credited as a_m_a_m
CVE-2026-13210 BR2026-0000-012005 unclaimed
Incorrect Authorization issue in CI/CD environment variable scope matcher impacts GitLab CE/EE
Credited as nwicks
CVE-2025-14871 BR2026-0000-012006 unclaimed
Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE
Credited as hunter0xp7
CVE-2026-1168 BR2026-0000-012007 unclaimed
Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE
Credited as joaxcar
CVE-2024-11222 BR2026-0000-012008 unclaimed
Race Condition issue in Merge Request Pipelines impacts GitLab CE/EE
Credited as xorz
CVE-2026-12910 BR2026-0000-012009 unclaimed
Improper Authentication issue in SAML SSO sign-in restriction enforcement impacts GitLab CE/EE
Credited as theluci
CVE-2026-82837 BR2026-0000-012010 unclaimed
Insufficiently Protected Credentials issue in Workhorse senddata emitters impacts GitLab CE/EE
Credited as 0xoroot
CVE-2026-19619 BR2026-0000-012011 unclaimed
Cross-site Scripting issue in Content Editor impacts GitLab CE/EE
Credited as lucvs
CVE-2026-7514 BR2026-0000-012012 unclaimed
Missing Authorization issue in Generic Package Registry impacts GitLab CE/EE
Credited as toofikz
CVE-2026-8030 BR2026-0000-012013 unclaimed
Improper Input Validation issue in Namespace Transfer impacts GitLab CE/EE
Credited as mateuszek
CVE-2026-16794 BR2026-0000-012014 unclaimed
Missing Authorization issue in Compliance Framework management impacts GitLab EE
Credited as manual_mint
CVE-2026-3855 BR2026-0000-012015 unclaimed
Improper Input Validation issue in Terraform State API impacts GitLab CE/EE
Credited as ahacker1