GitLab
GitLab Security Releases - December 2025
gitlab-2025-12 Dec 1, 2025 Source: Vendor
GitLab security advisories for December 2025: 7 CVEs, 5 credited researchers.
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
7 lines
Showing 1–7 of 7
CVE-2025-11247
BR2025-0000-031955
unclaimed
Information disclosure issue in compliance frameworks impacts GitLab EE
Credited as weasterhacker
CVE-2025-11984
BR2025-0000-031956
unclaimed
Authentication bypass issue for WebAuthn users impacts GitLab CE/EE
Credited as jcarre
CVE-2025-12029
BR2025-0000-031957
unclaimed
Cross-site scripting issue in Swagger UI impacts GitLab CE/EE
Credited as x0abcd_
CVE-2025-12562
BR2025-0000-031958
unclaimed
Denial of service issue in GraphQL endpoints impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-12716
BR2025-0000-031959
unclaimed
Cross-site scripting issue in Wiki impacts GitLab CE/EE
Credited as yvvdwf
CVE-2025-12734
BR2025-0000-031960
unclaimed
HTML injection issue in merge request titles impacts GitLab CE/EE
Credited as joaxcar
CVE-2025-8405
BR2025-0000-031961
unclaimed
Improper encoding in vulnerability reports impacts GitLab CE/EE
Credited as yvvdwf