CVE-2026-7377

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due to improper input sanitization.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-737707.3An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, CVE-2026-737717.5An authentication vulnerability exists in the AOS-CX management interface and API that may allow improper authentication processing. An unau CVE-2026-737726.5Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of-service condition b CVE-2026-737737.5An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability CVE-2026-737747.6A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensiti CVE-2026-737757.7Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive informatio CVE-2026-737767.9A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authent CVE-2026-737778.1Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to CVE-2026-737789.8A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote CVE-2026-737798.2Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor CVE-2026-73787.5Crash in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-737808.3A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF