Login Request a demo
GI
DevOps
GitLab
by GitLab · last CVE Oct 22, 2026
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Vulnerabilities1,508In the news12Timeline
Severity mix
Critical 70High 356Medium 74Low 0
Severity
All severities500Critical70High356Medium74Low0
Exploitation
On CISA KEV5Exploited in the wild5
Watch

Add GitLab to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-85706
In wildKEV
10.0
97%
Sep 12
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
Affected: 18.7 before 18.11.12; 19.0 before 19.0.9; 19.1 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2
CVE-2021-22205
RansomwareIn wildKEV
10.0
100%
Apr 23
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Affected: >=11.9, <13.8.8; >=13.9, <13.9.6; >=13.10, <13.10.3
CVE-2023-7028
In wildKEV
9.8
94%
Jan 12
Weak Password Recovery Mechanism for Forgotten Password in GitLab
Affected: 16.1 before 16.1.6; 16.2 before 16.2.9; 16.3 before 16.3.7; 16.4 before 16.4.5; 16.5 before 16.5.6; 16.6 before 16.6.4; +1 more
CVE-2021-22175
In wildKEV
9.8
53%
Jun 11
GitLab Server-Side Request Forgery (SSRF) Vulnerability
Affected: >=10.5, <13.6.7; >=13.7, <13.7.7; >=13.8, <13.8.4
CVE-2021-39935
In wildKEV
7.5
36%
Dec 13
GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
Affected: >=10.5, <14.3.6; >=14.4, <14.4.4; >=14.5, <14.5.2
Showing 5
The 500 most important CVEs for this product (exploited first, then by severity)