{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/enterprise-edition--19.1.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-87719"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CB41C932-3F63-547C-8278-6162A20CA9E3\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["GitLab Community Edition (\u003c 19.1.8, 19.2.x \u003c 19.2.6, 19.3.x \u003c 19.3.2)","GitLab Enterprise Edition (\u003c 19.1.8, 19.2.x \u003c 19.2.6, 19.3.x \u003c 19.3.2)","GitLab Community Edition (\u003c 19.1.8)","GitLab Enterprise Edition","Community Edition (\u003c 19.1.8)","Enterprise Edition (\u003c 19.1.8)","GitLab Community Edition (\u003e= 18.7, \u003c 19.1.8, \u003e= 19.2, \u003c 19.2.6, \u003e= 19.3, \u003c 19.3.2)","GitLab Enterprise Edition (\u003e= 18.7, \u003c 19.1.8, \u003e= 19.2, \u003c 19.2.6, \u003e= 19.3, \u003c 19.3.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","remote-code-execution","gitlab"],"_cs_type":"advisory","_cs_vendors":["GitLab"],"content_html":"\u003cp\u003eOn September 10, 2026, GitLab released critical security patches for its Community Edition (CE) and Enterprise Edition (EE) platforms. The update addresses a significant number of vulnerabilities reported by the CERT-FR in advisory CERTFR-2026-AVI-1160. These vulnerabilities affect GitLab versions prior to 19.1.8, as well as 19.2.x prior to 19.2.6, and 19.3.x prior to 19.3.2.\u003c/p\u003e\n\u003cp\u003eThe disclosed flaws include critical impacts such as remote code execution (RCE), denial-of-service (DoS), security policy bypasses, and unauthorized access to sensitive data. Given the breadth of vulnerabilities - ranging from RCE to cross-site scripting (XSS) - these patches are essential to maintain the integrity of development environments and source code repositories. Defenders should prioritize auditing internet-facing GitLab instances for these versions and applying the security patches immediately to mitigate the risk of exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities could result in full system compromise, exfiltration of proprietary source code, internal network reconnaissance, or localized denial-of-service, impacting the development lifecycle and data confidentiality for any organization running affected GitLab versions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of GitLab Community Edition and Enterprise Edition to the latest patched versions: 19.1.8, 19.2.6, or 19.3.2 as specified in the official GitLab security release.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous POST requests or unusual URI patterns targeting common GitLab endpoints, which could indicate exploitation attempts against these CVEs.\u003c/li\u003e\n\u003cli\u003ePatch the following CVEs: CVE-2024-11222, CVE-2025-14871, CVE-2026-1168, CVE-2026-12910, CVE-2026-13210, CVE-2026-16794, CVE-2026-19619, CVE-2026-3855, CVE-2026-7514, CVE-2026-78252, CVE-2026-79708, CVE-2026-8030, CVE-2026-82837, CVE-2026-85706, CVE-2026-86340, CVE-2026-86341, CVE-2026-87719, and CVE-2026-88765.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-14T19:10:33Z","date_published":"2026-09-11T18:55:51Z","id":"https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/","summary":"GitLab has released security patches addressing a large set of vulnerabilities across Community and Enterprise editions, including flaws leading to remote code execution and data confidentiality compromises.","title":"Multiple Vulnerabilities in GitLab CE and EE","url":"https://feed.craftedsignal.io/briefs/2026-09-gitlab-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Enterprise Edition (\u003c 19.1.8)","version":"https://jsonfeed.org/version/1.1"}