GitLab

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 10.0CriticalSep 11, 2026GitLab Community Edition and Enterprise Edition Path traversal / file handlingCVE-2026-85706GitLab Community Edition and Enterprise Edition are affected. An attacker gains access to sensitive files and data outside of the intended repository path. Update to the latest version of GitLab Community Edition and Enterprise Edition as soon as possible.Added to KEV Sep 11, 2026Exploited92% likelyExploit codeMetasploit · NucleiDetection
• 6.8MediumFeb 18, 2026GitLab SSRFCVE-2021-22175GitLab API and other services using the affected URL handling function. An attacker gains unauthorized access to internal services and data. Update to the latest version of GitLab, specifically patch version 14.10.3 or later.Added to KEV Feb 18, 2026Exploited53% likelyExploit codeNucleiDetection
• 6.8MediumFeb 3, 2026GitLab Community and Enterprise Editions SSRFCVE-2021-39935GitLab Community and Enterprise Editions. An attacker gains access to internal systems and services. Update GitLab to the latest version to mitigate this vulnerability.Added to KEV Feb 3, 2026Exploited36% likely
• 10.0CriticalJan 12, 2024GitLab CE/EE Auth bypass / access controlCVE-2023-7028GitLab Community and Enterprise Editions. An attacker gains unauthenticated access to sensitive information and potentially execute code. Update to the latest version of GitLab (as of my cut off knowledge it was 15.9.2).Added to KEV May 1, 2024 · 109 days after publicationExploited94% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 10.0CriticalApr 23, 2021GitLab Community and Enterprise Editions Code / command injectionCVE-2021-22205(1) GitLab Community and Enterprise Editions are affected. (2) An attacker gains remote code execution. (3) Update to the latest version of GitLab.Added to KEV Nov 3, 2021 · 193 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• –UnscoredOct 29, 2026GitLabADV-gitlab-3e8f3831e657On October 29, 2026, we released versions 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14 for GitLab Community Edition and Enterprise Edition. These versions resolve a number of regressions and bugs. This patch release does not include any security fixes. GitLab Community Edition and Enterprise Edition 19.5.3 [Backport 19.5] Distrust compromised eMudhra CA certificates Bump Go to 1.27.3 [19.5] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3 Backport of Stop jobs witho
• –UnscoredOct 22, 2026GitLabADV-cccs-6d09f5ca7872Serial Number: AV26-1074 Date: October 22, 2026 As of October 21, 2026, GitLab is affected by vulnerabilities in the following product: GitLab Community Edition (CE) and Enterprise Edition (EE) Prior to 18.11.13 Prior to 19.0.10 Prior to 19.1.9 Prior to 19.2.9 Prior to 19.3.6 Prior to 19.4.3 Prior to 19.5.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. GitLab Critical Patch Release: 19.5.1, 19.4.3,
• 8.2HighOct 22, 2026GitLabCVE-2026-15723GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
• 6.8MediumOct 22, 2026GitLab Auth bypass / access controlCVE-2026-12664GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing the token's restrictions, due to insufficient scope enforcement on a GraphQL field.
• 10.0CriticalOct 22, 2026GitLab Memory corruptionCVE-2026-110264An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.Exploit code
• 4.3MediumOct 21, 2026GitLab Auth bypass / access controlCVE-2026-13319GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API.
• 3.1LowOct 21, 2026GitLabCVE-2026-14288GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access con
• 5.9MediumOct 21, 2026GitLab Auth bypass / access controlCVE-2026-16255GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the
• 2.7LowOct 21, 2026GitLab Auth bypass / access controlCVE-2026-103515GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egres
• 3.5LowOct 21, 2026GitLabCVE-2026-105711GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users.
• 4.3MediumOct 21, 2026GitLab Information disclosureCVE-2026-105777GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers.
• 4.3MediumOct 21, 2026GitLabCVE-2026-112378GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side valida
• 7.5HighOct 21, 2026GitLabCVE-2026-112212GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
• 3.1LowOct 21, 2026GitLabCVE-2026-112326GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling.
• 4.2MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-5954GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.
• 4.3MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-6567GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authoriz
• 5.8MediumOct 13, 2026GitLabCVE-2026-7767GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an
• 2.7LowOct 13, 2026GitLab Auth bypass / access controlCVE-2026-9268GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper
• 4.3MediumOct 13, 2026GitLabCVE-2026-14210GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a project-scoped fine-grained Personal Access Token to permanently delete or modify
• 4.3MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-14552GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Guest access to read confidential epic content meant to be restricted by external au
• 8.2HighOct 13, 2026GitLabCVE-2026-14814GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially
• 5.3MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-16275GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks.
• 8.5HighOct 13, 2026GitLab Auth bypass / access controlCVE-2026-16301GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorizatio
• 4.2MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-78335GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belong
• 7.7HighOct 13, 2026GitLab Auth bypass / access controlCVE-2026-81839GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privilege
• 3.1LowOct 13, 2026GitLab Auth bypass / access controlCVE-2026-82632GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions
• 5.3MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-84284GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authoriza
• 5.3MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-85529GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper
• 4.2MediumOct 13, 2026GitLab Auth bypass / access controlCVE-2026-92528GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identi
• 8.7HighOct 13, 2026GitLab XSSCVE-2026-92883GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a sp
• 10.0CriticalOct 13, 2026GitLab Memory corruptionCVE-2026-97229(1) GitLab CE/EE versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. (2) An attacker gains the ability to execute arbitrary code on the GitLab server. (3) Update to the latest version of GitLab CE/EE, specifically 19.2.8 or later, 19.3.5 or later, or 19.4.2 or later.Exploit code
• 7.3HighOct 13, 2026GitLabCVE-2026-96893GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintend
• 3.5LowOct 13, 2026GitLab SSRFCVE-2026-100104GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to perform server-side request forgery and reach internal network resources due to a time
• 4.6MediumOct 13, 2026GitLabCVE-2026-100755GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain deployment configurations, could have allowed an authenticated user to poison cached page content served to other users due to improper cache
• 6.2MediumOct 13, 2026GitLab Information disclosureCVE-2026-101168GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with access to GitLab Pages log data to obtain access tokens and other secrets, due to in
• 2.7LowOct 13, 2026GitLab Auth bypass / access controlCVE-2026-103549GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with maintainer-role permissions to remove certain package registry metadata that package
• 4.3MediumOct 13, 2026GitLab Privilege escalationCVE-2026-104661GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a custom role with compliance framework administration permissions to configure and
• 4.3MediumOct 13, 2026GitLabCVE-2026-105458GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypa
• 6.5MediumOct 7, 2026GitLab Denial of serviceCVE-2026-1403GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file stru
• 9.9CriticalOct 2, 2026GitLab AI Gateway Code / command injectionCVE-2026-90970GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape th
• 3.7LowSep 29, 2026GitLab Auth bypass / access controlCVE-2026-4523GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper au
• 4.3MediumSep 29, 2026GitLab Auth bypass / access controlCVE-2026-8937GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects they
• 4.3MediumSep 29, 2026GitLab Auth bypass / access controlCVE-2026-10518GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authorized
• 8.7HighSep 29, 2026GitLab XSSCVE-2026-84739GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to im
• 9.9CriticalSep 23, 2026GitLab Memory corruptionCVE-2026-89078GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a sp
• 4.3MediumSep 23, 2026GitLabCVE-2026-92530GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the
• 7.7HighSep 23, 2026GitLab Auth bypass / access controlCVE-2026-92470GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubl
• 4.3MediumSep 23, 2026GitLab Auth bypass / access controlCVE-2026-92529GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for wor
• 5.4MediumSep 23, 2026GitLab Auth bypass / access controlCVE-2026-92874GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to
• 3.1LowSep 23, 2026GitLabCVE-2026-92628GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context.

See every GitLab entry on the dashboard.

Top products

• GitLab278 CVEs in the last year, 6 critical, 1 exploited
• GitLab AI Gateway2 CVEs in the last year, 2 critical
• Community Edition and Enterprise Edition1 CVE in the last year, 1 critical, 1 exploited
• Community and Enterprise Editions1 CVE in the last year, 1 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• GitLab · Oct 29, 2026GitLab Patch Release: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14ADV-gitlab-3e8f3831e657
• oss-security · Oct 23, 2026Ruby Regexp compilation fixes related to GitLab s CVE sCVE-2026-110264CVE-2026-89078CVE-2026-93577CVE-2026-97229
• CCCS (Canada) · Oct 22, 2026GitLab security advisory (AV26-1074)ADV-cccs-6d09f5ca7872
• GitLab · Oct 21, 2026GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13CVE-2026-103515CVE-2026-105711CVE-2026-105777CVE-2026-110264CVE-2026-112212CVE-2026-112326
• GitLab · Oct 12, 2026GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8CVE-2026-100104CVE-2026-100755CVE-2026-101168CVE-2026-103549CVE-2026-104661CVE-2026-105458
• GitLab · Oct 2, 2026GitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1CVE-2026-90970
• GitLab · Sep 23, 2026GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7CVE-2026-10518CVE-2026-4523CVE-2026-84739CVE-2026-89078CVE-2026-8937CVE-2026-92470
• GitLab · Sep 23, 2026GitLab Critical Patch Release: 19.0.9, 18.11.12CVE-2026-85706CVE-2026-87719
• GitLab · Sep 10, 2026GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8CVE-2024-11222CVE-2025-14871CVE-2026-1168CVE-2026-12910CVE-2026-13210CVE-2026-16794
• GitLab · Aug 26, 2026GitLab Patch Release: 19.3.1, 19.2.5, 19.1.7CVE-2025-10903CVE-2026-15387CVE-2026-18252CVE-2026-3035CVE-2026-4398CVE-2026-7487
• GitLab · Aug 17, 2026GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11CVE-2026-19478CVE-2026-19650
• GitLab · Aug 12, 2026GitLab Patch Release: 19.2.2, 19.1.4, 19.0.6CVE-2025-9486CVE-2026-10053CVE-2026-15216CVE-2026-15217CVE-2026-15423CVE-2026-16494
• GitLab · Aug 6, 2026GitLab Patch Release: 18.11.9ADV-gitlab-16c835be7d60
• GitLab · Jul 29, 2026GitLab Patch Release: 19.2.1, 19.1.3, 19.0.5CVE-2025-14562CVE-2026-12436CVE-2026-13113CVE-2026-14341CVE-2026-14351CVE-2026-15077
• GitLab · Jul 8, 2026GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7CVE-2025-12506CVE-2026-11827CVE-2026-13151CVE-2026-13320CVE-2026-6352CVE-2026-6896