Critical GitLab flaw (CVSS 10.0) allows unauthenticated RCE

GitLab released fixes on October 21 for a flaw that lets attackers run code on self-managed servers without logging in. It affects every release back to 7.0 from 2014, and the October 12 patch covered only versions 19.2 and later.

• CVSS 10.0 flaw enables unauthenticated RCE on self-managed GitLab
• All releases since 7.0 (2014) are affected — 12 years of versions
• The October 12 update fixed only 19.2 and later
• New fixed versions sit one patch above the previous ones