GitLab
GitLab Patch Release: 18.11.1, 18.10.4, 18.9.6
patch-release-gitlab-18-11-1-released Apr 22, 2026 Source: Vendor
Imported by the GitLab patch release catcher from https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-1-released/. 11 CVE sections listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-1-released/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
10 lines
Showing 1–10 of 10
CVE-2026-4922
BR2026-0000-008851
unclaimed
Cross-Site Request Forgery issue in GraphQL API impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-5816
BR2026-0000-008852
unclaimed
Improper Resolution of Path Equivalence issue in Web IDE asset impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-5262
BR2026-0000-008853
unclaimed
Cross-site Scripting issue in Storybook impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-0186
BR2026-0000-008854
unclaimed
Denial of Service issue in discussions endpoint impacts GitLab CE/EE
Credited as pwnie
CVE-2026-1660
BR2026-0000-008855
unclaimed
Denial of Service issue in Jira import impacts GitLab CE/EE
Credited as a92847865
CVE-2025-6016
BR2026-0000-008856
unclaimed
Denial of Service issue in notes endpoint impacts GitLab CE/EE
Credited as pwnie
CVE-2025-3922
BR2026-0000-008857
unclaimed
Denial of Service issue in GraphQL API impacts GitLab CE/EE
Credited as pwnie
CVE-2026-5377
BR2026-0000-008858
unclaimed
Improper Access Control issue in issue description renderer impacts GitLab CE/EE
Credited as yvvdwf
CVE-2026-3254
BR2026-0000-008859
unclaimed
Improper Restriction of Rendered UI Layers or Frames issue in Mermaid sandbox impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-9957
BR2026-0000-008860
unclaimed
Improper Access Control issue in project fork relationship API impacts GitLab CE/EE
Credited as theluci