GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85706 In wildKEV | 10.0 | Sep 12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab Affected: 18.7 before 18.11.12; 19.0 before 19.0.9; 19.1 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2021-22205 RansomwareIn wildKEV | 10.0 | Apr 23 | GitLab Community and Enterprise Editions Remote Code Execution Vulnerability Affected: >=11.9, <13.8.8; >=13.9, <13.9.6; >=13.10, <13.10.3 |
| CVE-2023-7028 In wildKEV | 9.8 | Jan 12 | Weak Password Recovery Mechanism for Forgotten Password in GitLab Affected: 16.1 before 16.1.6; 16.2 before 16.2.9; 16.3 before 16.3.7; 16.4 before 16.4.5; 16.5 before 16.5.6; 16.6 before 16.6.4; +1 more |
| CVE-2021-22175 In wildKEV | 9.8 | Jun 11 | GitLab Server-Side Request Forgery (SSRF) Vulnerability Affected: >=10.5, <13.6.7; >=13.7, <13.7.7; >=13.8, <13.8.4 |
| CVE-2021-39935 In wildKEV | 7.5 | Dec 13 | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability Affected: >=10.5, <14.3.6; >=14.4, <14.4.4; >=14.5, <14.5.2 |
| CVE-2026-110264 New | 10.0 | Oct 22 | Integer Overflow or Wraparound in GitLab Affected: 7.0 before 18.11.13; 19.0 before 19.0.10; 19.1 before 19.1.9; 19.2 before 19.2.9; 19.3 before 19.3.6; 19.4 before 19.4.3; +1 more |
| CVE-2026-97229 | 10.0 | Oct 13 | Integer Overflow or Wraparound in GitLab Affected: 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2020-13300 | 10.0 | Sep 14 | GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow Affected: 13.3.0 before 13.3.4; 13.3.0 before 13.3.4 |
| CVE-2019-9174 | 10.0 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2018-18843 | 10.0 | Dec 4 | The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF Affected: 11.0.0 before 11.2.8; 11.3.0 before 11.3.9; 11.4.0 before 11.4.4 |
| CVE-2026-89078 | 9.9 | Sep 23 | Double Free in GitLab Affected: 19.2 before 19.2.7; 19.3 before 19.3.3; 19.4 before 19.4.1 |
| CVE-2026-93577 | 9.9 | Sep 23 | Integer Overflow or Wraparound in GitLab Affected: 19.2 before 19.2.7; 19.3 before 19.3.3; 19.4 before 19.4.1 |
| CVE-2026-87719 | 9.9 | Sep 12 | Deserialization of Untrusted Data in GitLab Affected: 18.3 before 18.11.12; 19.0 before 19.0.9; 19.1 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2025-5121 | 9.9 | Jun 20 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.4 and 18.0 before 18.0.2 Affected: 17.11.0 before 17.11.4; 17.11.0 before 17.11.4; 18.0.0 before 18.0.2; 18.0.0 before 18.0.2 |
| CVE-2024-0402 | 9.9 | Jan 26 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to… Affected: 16.0.0 before 16.5.8; 16.0.0 before 16.5.8; 16.6.0 before 16.6.6; 16.6.0 before 16.6.6; 16.7.0 before 16.7.4; 16.7.0 before 16.7.4; +2 more |
| CVE-2022-2884 | 9.9 | Oct 17 | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code… Affected: >=11.3.4, <15.1.5; >=15.2, <15.2.3; >=15.3, <15.3.1 |
| CVE-2022-2992 | 9.9 | Oct 17 | A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via… Affected: >=11.10, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2024-45409 | 9.8 | Sep 10 | The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector Affected: before 16.11.10; 17.0.0 before 17.0.8; 17.1.0 before 17.1.8; 17.2.0 before 17.2.7; 17.3.0 before 17.3.3 |
| CVE-2024-6385 | 9.8 | Jul 11 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2,… Affected: 15.8.0 before 16.11.6; 15.8.0 before 16.11.6; 17.0.0 before 17.0.4; 17.0.0 before 17.0.4; 17.1.0 before 17.1.2; 17.1.0 before 17.1.2 |
| CVE-2023-5009 | 9.8 | Sep 19 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4 Affected: 13.12 before 16.2.7; 16.3 before 16.3.4 |
| CVE-2023-4008 | 9.8 | Aug 3 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from… Affected: 15.9.0 before 16.0.8; 15.9.0 before 16.0.8; 16.1 before 16.1.3; 16.1 before 16.1.3; 16.2 before 16.2.2; 16.2 before 16.2.2 |
| CVE-2018-17452 | 9.8 | Apr 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 Affected: before 11.1.7; before 11.1.7; 11.2.0 before 11.2.4; 11.2.0 before 11.2.4; 11.3.0; 11.3.0 |
| CVE-2023-1708 | 9.8 | Apr 5 | An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets… Affected: 1.0.0 before 15.8.5; 1.0.0 before 15.8.5; 15.9.0 before 15.9.4; 15.9.0 before 15.9.4; 15.10.0; 15.10.0 |
| CVE-2022-2826 | 9.8 | Oct 28 | An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0… Affected: >=10.0, <12.9.8; >=12.10, <12.10.7; >=13.0, <13.0.1 |
| CVE-2022-1162 | 9.8 | Apr 4 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g Affected: 14.7.0 before 14.7.7; 14.7.0 before 14.7.7; 14.8.0 before 14.8.5; 14.8.0 before 14.8.5; 14.9.0 before 14.9.2; 14.9.0 before 14.9.2 |
| CVE-2022-0735 | 9.8 | Mar 28 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from… Affected: 12.0 before 14.6.5; 12.0 before 14.6.5; 14.7 before 14.7.4; 14.7 before 14.7.4; 14.8 before 14.8.2; 14.8 before 14.8.2 |
| CVE-2021-39890 | 9.8 | Dec 6 | It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above Affected: 14.1.1 before 14.1.7; 14.2.0 before 14.2.5; 14.3.0; 14.3.0; 14.3.1; 14.3.1 |
| CVE-2021-22203 | 9.8 | Apr 2 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions starting from 13.9 before 13.9.5, and all versions starting… Affected: 13.7.9 before 13.8.7; 13.7.9 before 13.8.7; 13.9.0 before 13.9.5; 13.9.0 before 13.9.5; 13.10.0; 13.10.0 |
| CVE-2020-13312 | 9.8 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: 13.1.0 before 13.1.10; 13.1.0 before 13.1.10; 13.2.0 before 13.2.8; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4; 13.3.0 before 13.3.4 |
| CVE-2020-10980 | 9.8 | Apr 8 | GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration Affected: 8.0.0 through 12.9; 8.0.0 through 12.9 |
| CVE-2020-10956 | 9.8 | Mar 27 | GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature Affected: 8.10.0 before 12.9.1; 8.10.0 before 12.9.1 |
| CVE-2020-10077 | 9.8 | Mar 13 | GitLab EE 3.0 through 12.8.1 allows SSRF Affected: 3.0.0 through 12.8.1 |
| CVE-2020-10074 | 9.8 | Mar 13 | GitLab 10.1 through 12.8.1 has Incorrect Access Control Affected: 10.1.0 through 12.8.1; 10.1.0 through 12.8.1 |
| CVE-2019-12443 | 9.8 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11 Affected: 11.9.0 through 11.11.0; 11.9.0 through 11.11.0 |
| CVE-2019-12428 | 9.8 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11 Affected: 6.8.0 through 11.11.0; 6.8.0 through 11.11.0 |
| CVE-2020-8113 | 9.8 | Mar 6 | GitLab 10.7 and later through 12.7.2 has Incorrect Access Control Affected: 10.7.0 before 12.6.8; 10.7.0 before 12.6.8; 12.7.0 through 12.7.2; 12.7.0 through 12.7.2 |
| CVE-2020-8114 | 9.8 | Feb 5 | GitLab EE 8.9 and later through 12.7.2 has Insecure Permission Affected: 8.9.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
| CVE-2019-5464 | 9.8 | Jan 28 | A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized Affected: 10.2.0 before 11.11.7; 10.2.0 before 11.11.7 |
| CVE-2019-15585 | 9.8 | Jan 28 | Improper authentication exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) in the GitLab SAML integration had a validation… Affected: 12.1.0 before 12.1.12; 12.1.0 before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-19628 | 9.8 | Jan 5 | In GitLab EE 11.3 through 12.5.3, 12.4.5, and 12.3.8, insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code… Affected: 11.3.0 through 12.3.8; 12.4.0 through 12.4.5; 12.5.0 through 12.5.3 |
| CVE-2019-19088 | 9.8 | Jan 3 | Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal Affected: 11.3.0 before 12.5.1 |
| CVE-2019-6960 | 9.8 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 9.3.0 through 9.3.7; 9.3.0 through 9.3.7; 10.0.0 through 10.8.7; 10.0.0 through 10.8.7; 11.0.0 before 11.5.8; 11.0.0 before 11.5.8; +4 more |
| CVE-2019-14943 | 9.8 | Aug 29 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4 Affected: 12.0 through 12.1.4; 12.0 through 12.1.4 |
| CVE-2019-9732 | 9.8 | May 29 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: 10.8.0 through 10.8.7; 10.8.0 through 10.8.7; 11.0.0 before 11.6.10; 11.0.0 before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; +2 more |
| CVE-2019-9485 | 9.8 | May 29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2019-9218 | 9.8 | May 29 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2019-9756 | 9.8 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: 10.8.0 through 10.8.7; 10.8.0 through 10.8.7; 11.0.0 before 11.6.10; 11.0.0 before 11.6.10; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2019-9217 | 9.8 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2018-18641 | 9.8 | Dec 4 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3 Affected: 8.10.0 before 11.2.7; 8.10.0 before 11.2.7; 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3 |
| CVE-2018-18649 | 9.8 | Nov 29 | An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3 Affected: 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3 |
The 500 most important CVEs for this product (exploited first, then by severity)