CVE-2025-12983

MediumCVSS 6.5/10Last modified Oct 19, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to cause a denial of service condition by submitting specially crafted markdown content with nested formatting patterns.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2025
Last modified
Oct 19, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-129844.9The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to,CVE-2025-129858.4IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a containeCVE-2025-129866.0When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformeCVE-2025-12994.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 beforeCVE-2025-129945.3Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that coCVE-2025-129959.8Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used tCVE-2025-129964.1Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errorCVE-2025-129973.1Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific CVE-2025-129988.2Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, fCVE-2025-129999.1UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-ForwardCVE-2025-13006.1CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker webCVE-2025-130007.7The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscr