CVE-2025-6195

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain configuration conditions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2025
Last modified
Oct 18, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-619505.3In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. WCVE-2025-619517.5Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer SCVE-2025-619527.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-619558.8A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.CVE-2025-619569.8Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. AttaCVE-2025-619588.7A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypassCVE-2025-619595.3Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requestsCVE-2025-61965.5A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially craftCVE-2025-619607.5When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management MCVE-2025-619625.9In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.CVE-2025-619697.0Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resultiCVE-2025-61974.2An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -
CVE-2025-6195: Medium severity, CVSS 4.3 | Vulnix