GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-18646 | 8.8 | Dec 4 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3 Affected: 5.3 before 11.2.7; 5.3 before 11.2.7; 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3 |
| CVE-2018-14603 | 8.8 | Jul 27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2 Affected: before 10.8.7; before 10.8.7; 11.0.0 before 11.0.5; 11.0.0 before 11.0.5; 11.1.0 before 11.1.2; 11.1.0 before 11.1.2 |
| CVE-2017-0926 | 8.8 | Mar 21 | Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login Affected: 8.8.0 through 9.5.10; 8.8.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2017-0918 | 8.8 | Mar 21 | Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution Affected: 8.4.0 through 9.5.10; 8.4.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.15; after 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2017-12426 | 8.8 | Aug 14 | GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4… Affected: through 8.17.7; through 8.17.7; 9.0.0; 9.0.0; 9.0.1; 9.0.1; +34 more |
| CVE-2016-4340 | 8.8 | Jan 23 | The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated… Affected: 8.2.0; 8.2.1; 8.2.2; 8.2.3; 8.2.4; 8.3.0; +34 more |
| CVE-2026-92883 | 8.7 | Oct 13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 19.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2026-84739 | 8.7 | Sep 29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 13.11 before 19.2.7; 19.3 before 19.3.3; 19.4 before 19.4.1 |
| CVE-2026-15217 | 8.7 | Aug 12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 18.2 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-15216 | 8.7 | Aug 12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 18.2 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-8589 | 8.7 | Jun 11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 13.1.4 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2026-10087 | 8.7 | Jun 11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 17.1 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2025-12716 | 8.7 | Dec 11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 18.4 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-4278 | 8.7 | Jun 12 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2 Affected: 18.0.0 before 18.0.2; 18.0.0 before 18.0.2 |
| CVE-2025-1763 | 8.7 | May 30 | An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting… Affected: 16.6.0 before 17.9.7; 16.6.0 before 17.9.7; 17.10.0 before 17.10.5; 17.10.0 before 17.10.5; 17.11.0; 17.11.0 |
| CVE-2024-11274 | 8.7 | Dec 12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2,… Affected: 16.1.0 before 17.4.6; 16.1.0 before 17.4.6; 17.5.0 before 17.5.4; 17.5.0 before 17.5.4; 17.6.0 before 17.6.2; 17.6.0 before 17.6.2 |
| CVE-2024-1451 | 8.7 | Feb 22 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1 Affected: 16.9.0 |
| CVE-2020-13340 | 8.7 | Oct 8 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log Affected: before 13.2.10; before 13.2.10; 13.3.0 before 13.3.7; 13.3.0 before 13.3.7; 13.4.0 before 13.4.2; 13.4.0 before 13.4.2 |
| CVE-2021-22214 | 8.6 | Jun 8 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible… Affected: 10.5 before 13.10.5; 13.11 before 13.11.5; 13.12 before 13.12.2 |
| CVE-2026-16301 | 8.5 | Oct 13 | Incorrect Authorization in GitLab Affected: 18.7 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2026-79708 | 8.5 | Sep 16 | Incorrect Authorization in GitLab Affected: 19.0 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2026-88765 | 8.5 | Sep 15 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab Affected: 12.3 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2026-19228 | 8.5 | Aug 12 | Authorization Bypass Through User-Controlled Key in GitLab Affected: 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-15423 | 8.5 | Aug 12 | Incorrect Authorization in GitLab Affected: 19.0 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-5173 | 8.5 | Apr 8 | Exposed Dangerous Method or Function in GitLab Affected: 16.9.6 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2022-4037 | 8.5 | Jan 12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2 Affected: before 15.5.7; before 15.5.7; 15.6.0 before 15.6.4; 15.6.0 before 15.6.4; 15.7.0 before 15.7.2; 15.7.0 before 15.7.2 |
| CVE-2026-12436 | 8.4 | Jul 29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab Affected: 18.0 before 19.0.5; 19.1 before 19.1.3; 19.2 before 19.2.1 |
| CVE-2020-13321 | 8.3 | Sep 30 | A vulnerability was discovered in GitLab versions prior to 13.1 Affected: before 12.10.13; 13.0.0 before 13.0.8; 13.1.0 before 13.1.2 |
| CVE-2026-15723 New | 8.2 | Oct 21 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab Affected: 10.1 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-14814 | 8.2 | Oct 13 | Permissive Regular Expression in GitLab Affected: before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2026-4868 | 8.2 | May 27 | Authorization Bypass Through User-Controlled Key in GitLab Affected: 18.8 before 18.10.7; 18.11 before 18.11.4; 19.0 before 19.0.1 |
| CVE-2024-4835 | 8.2 | May 23 | A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 Affected: 15.11.0 before 16.10.6; 15.11.0 before 16.10.6; 16.11.0 before 16.11.3; 16.11.0 before 16.11.3; 17.0.0; 17.0.0 |
| CVE-2020-13356 | 8.2 | Nov 19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9 Affected: 8.8.9 before 13.3.9; 8.8.9 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2016-9469 | 8.2 | Mar 28 | Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance Affected: 8.13.0; 8.13.0; 8.13.1; 8.13.1; 8.13.2; 8.13.2; +16 more |
| CVE-2026-18252 | 8.1 | Aug 26 | Inclusion of Functionality from Untrusted Control Sphere in GitLab Affected: 18.9 before 19.1.7; 19.2 before 19.2.5; 19.3 before 19.3.1 |
| CVE-2026-1322 | 8.1 | May 14 | Business Logic Errors in GitLab Affected: 16.0 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-4922 | 8.1 | Apr 22 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 17.0 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2026-5816 | 8.1 | Apr 22 | Improper Resolution of Path Equivalence in GitLab Affected: 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2026-2745 | 8.1 | Mar 25 | Authentication Bypass Using an Alternate Path or Channel in GitLab Affected: 7.11 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-11989 | 8.1 | Oct 27 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated… Affected: 17.6.0 before 18.3.5; 18.4.0 before 18.4.3; 18.5.0 |
| CVE-2024-4994 | 8.1 | Jun 20 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0… Affected: 16.1.0 before 16.11.5; 16.1.0 before 16.11.5; 17.0.0 before 17.0.3; 17.0.0 before 17.0.3; 17.1.0; 17.1.0 |
| CVE-2024-8977 | 8.1 | Oct 10 | An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2 Affected: 15.10 before 17.2.9; 17.3.0 before 17.3.5; 17.4.0 before 17.4.2 |
| CVE-2024-8754 | 8.1 | Sep 12 | An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 Affected: 16.9.7 before 17.1.7; 16.9.7 before 17.1.7; 17.2.0 before 17.2.5; 17.2.0 before 17.2.5; 17.3.0 before 17.3.2; 17.3.0 before 17.3.2 |
| CVE-2024-3035 | 8.1 | Aug 8 | A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens… Affected: 8.12.0 before 17.0.6; 8.12.0 before 17.0.6; 17.1 before 17.1.4; 17.1.0 before 17.1.4; 17.2.0 before 17.2.2; 17.2.0 before 17.2.2 |
| CVE-2024-2434 | 8.1 | Apr 25 | An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could… Affected: 16.9.0 before 16.9.6; 16.9.0 before 16.9.6; 16.10.0 before 16.10.4; 16.10.0 before 16.10.4; 16.11.0; 16.11.0 |
| CVE-2024-1299 | 8.1 | Mar 7 | A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2 Affected: 16.8.0 before 16.8.4; 16.8.0 before 16.8.4; 16.9.0 before 16.9.2; 16.9.0 before 16.9.2 |
| CVE-2023-6680 | 8.1 | Dec 15 | An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2… Affected: 11.6 before 16.4.4; 16.5 before 16.5.4; 16.6 before 16.6.2 |
| CVE-2023-5332 | 8.1 | Dec 4 | Patch in third party library Consul requires 'enable-script-checks' to be set to False Affected: 9.5.0 before 16.2.8; 16.3.0 before 16.3.5; 16.4.0 |
| CVE-2023-0805 | 8.1 | May 3 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from… Affected: 15.2 before 15.9.6; 15.10 before 15.10.5; 15.11 before 15.11.1 |
| CVE-2022-4138 | 8.1 | Feb 13 | A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions… Affected: before 15.6.7; before 15.6.7; 15.7 before 15.7.6; 15.7 before 15.7.6; 15.8 before 15.8.1; 15.8 before 15.8.1 |
The 500 most important CVEs for this product (exploited first, then by severity)