GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-14364 | 9.8 | Jul 18 | GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code… Affected: before 10.7.7; before 10.7.7; 10.8.0 before 10.8.6; 10.8.0 before 10.8.6; 11.0 before 11.0.4; 11.0 before 11.0.4 |
| CVE-2018-8971 | 9.8 | Mar 24 | The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users Affected: through 10.3.8; 10.4.0 through 10.4.5; 10.5.0 through 10.5.5 |
| CVE-2017-0916 | 9.8 | Mar 21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution Affected: 8.8.0 through 10.1.5; 8.8.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; 10.3.0 through 10.3.3; 10.3.0 through 10.3.3 |
| CVE-2017-0915 | 9.8 | Mar 21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution Affected: 8.9.0 through 9.5.10; 8.9.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-75871 | 9.6 | Aug 27 | Server-Side Request Forgery (SSRF) in GitLab AI Gateway Affected: 18.10.0 before 19.0.12; 19.1.0 before 19.1.7; 19.2.0 before 19.2.2 |
| CVE-2025-13761 | 9.6 | Jan 9 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute… Affected: 18.6.0 before 18.6.3; 18.6.0 before 18.6.3; 18.7.0; 18.7.0 |
| CVE-2025-9642 | 9.6 | Sep 26 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could allow an attacker to inject… Affected: 14.10.0 before 18.2.7; 14.10.0 before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2020-13292 | 9.6 | Aug 10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow Affected: 12.3.0 before 13.0.12; 13.1.0 before 13.1.6; 13.2.0 before 13.2.3 |
| CVE-2026-19478 | 9.1 | Aug 17 | Improper Control of Generation of Code ('Code Injection') in GitLab Affected: 18.2 before 18.11.11; 19.0 before 19.0.8; 19.1 before 19.1.6; 19.2 before 19.2.4 |
| CVE-2025-7659 | 9.1 | Feb 11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an… Affected: 18.2.0 before 18.6.6; 18.2.0 before 18.6.6; 18.7.0 before 18.7.4; 18.7.0 before 18.7.4; 18.8.0 before 18.8.4; 18.8.0 before 18.8.4 |
| CVE-2023-3441 | 9.1 | Oct 1 | An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4 Affected: 8.0.0 before 16.4.0; 8.0.0 before 16.4.0 |
| CVE-2024-2743 | 9.1 | Sep 12 | An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST… Affected: 13.3.0 before 17.1.7; 17.2.0 before 17.2.5; 17.3.0 before 17.3.2 |
| CVE-2022-0249 | 9.1 | Mar 28 | A vulnerability was discovered in GitLab starting with version 12 Affected: 12.0 through 14.5.4; 14.6 through 14.6.4; 14.7 through 14.7.1 |
| CVE-2020-13347 | 9.1 | Oct 7 | A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1 Affected: 12.0.0 before 13.2.4; 12.0.0 before 13.2.4; 13.3.0 before 13.3.2; 13.3.0 before 13.3.2; 13.4.0 before 13.4.1; 13.4.0 before 13.4.1 |
| CVE-2020-10083 | 9.1 | Mar 13 | GitLab 12.7 through 12.8.1 has Insecure Permissions Affected: 12.7.0 through 12.8.1; 12.7.0 through 12.8.1 |
| CVE-2019-7353 | 9.1 | May 17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4 Affected: 11.7.0 before 11.7.4; 11.7.0 before 11.7.4 |
| CVE-2019-5883 | 9.1 | May 17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 Affected: 6.0.0 before 11.3.11; 6.0.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2019-9890 | 9.1 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: 10.0.0 before 11.6.10; 10.0.0 before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2026-16627 | 9.0 | Aug 12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 19.2 before 19.2.2 |
| CVE-2022-3726 | 9.0 | Nov 10 | Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to… Affected: 12.6.0 before 15.3.5; 12.6.0 before 15.3.5; 15.4.0 before 15.4.4; 15.4.0 before 15.4.4; 15.5.0 before 15.5.2; 15.5.0 before 15.5.2 |
The 500 most important CVEs for this product (exploited first, then by severity)