CVE-2025-9958

HighCVSS 7.7/10Last modified Oct 19, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published: Sep 26, 2025
Last modified: Oct 19, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-99597.6Incomplete validation of dunder attributes allows an attacker to escape from the Local Python execution environment sandbox, enforced by smo CVE-2025-99606.9A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF). This issue affect CVE-2025-99618.6An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be CVE-2025-996210.0A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affects CVE-2025-99639.4A path traversal vulnerability in Novakon P series allows to expose the root file system "/" and modify all files with root permissions. Thi CVE-2025-99648.6No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P CVE-2025-99659.3Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to th CVE-2025-99667.3Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This CVE-2025-99679.8The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and in CVE-2025-99688.5A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a spec CVE-2025-99697.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Pa CVE-2025-99707.4Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.