Login Request a demo
GI
DevOps
GitLab
by GitLab · last CVE Oct 22, 2026
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Vulnerabilities1,508In the news12Timeline
Severity mix
Critical 70High 356Medium 74Low 0
Severity
All severities500Critical70High356Medium74Low0
Exploitation
On CISA KEV5Exploited in the wild5
Watch

Add GitLab to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-39937
8.8
1%
Dec 13
A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before…
Affected: before 14.3.6; before 14.3.6; 14.4.0 before 14.4.4; 14.4.0 before 14.4.4; 14.5.0 before 14.5.2; 14.5.0 before 14.5.2
CVE-2021-22236
8.8
1%
Aug 25
Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application
Affected: 14.1.0 before 14.1.2; 14.1.0 before 14.1.2
CVE-2021-22192
8.8
13%
Mar 24
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server
Affected: 13.2.0 before 13.7.9; 13.2.0 before 13.7.9; 13.8.0 before 13.8.6; 13.8.0 before 13.8.6; 13.9.0 before 13.9.4; 13.9.0 before 13.9.4
CVE-2020-13343
8.8
2%
Oct 6
An issue has been discovered in GitLab affecting all versions starting from 11.2
Affected: 11.2.0 through 13.4.3; 11.2.0 through 13.4.3
CVE-2020-13296
8.8
2%
Sep 30
An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6
Affected: through 10.7; 13.0.0 before 13.0.14; 13.1.0 before 13.1.8; 13.2.0 before 13.2.6
CVE-2020-13309
8.8
1%
Sep 14
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4
Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4
CVE-2020-13263
8.8
1%
Jun 19
An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as…
Affected: 9.5.0 before 12.9.8; 9.5.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0
CVE-2020-13272
8.8
1%
Jun 19
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow
Affected: 12.3.0 before 12.9.8; 12.3.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0
CVE-2020-13270
8.8
1%
Jun 10
Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API
Affected: 11.3.0 before 11.9.8; 11.3.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0 before 13.0.1; 13.0.0 before 13.0.1
CVE-2019-12430
8.8
3%
Mar 10
An issue was discovered in GitLab Community and Enterprise Edition 11.11
Affected: 11.11.0; 11.11.0
CVE-2013-4583
8.8
2%
Jan 28
The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows…
Affected: 5.0.0 before 5.4.2; 6.0.0 before 6.2.1; 6.0.0 before 6.2.4
CVE-2019-5468
8.8
2%
Jan 28
An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account
Affected: 11.11.0 before 11.11.6; 11.11.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2
CVE-2019-5462
8.8
3%
Jan 28
A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed
Affected: 9.0.0 before 11.11.7; 9.0.0 before 11.11.7
CVE-2019-19261
8.8
1%
Jan 3
GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF
Affected: 6.7.0 before 12.5.1
CVE-2019-5486
8.8
2%
Dec 18
A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an…
Affected: before 12.1.10; before 12.1.10; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2
CVE-2019-15589
8.8
1%
Dec 18
An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained…
Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2
CVE-2019-18457
8.8
1%
Nov 26
An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens
Affected: 11.8.0 through 12.4.0; 11.8.0 through 12.4.0
CVE-2019-6783
8.8
6%
Sep 9
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1
Affected: 8.3.0 before 11.5.8; 8.17.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1
CVE-2018-19569
8.8
2%
Jul 10
GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI…
Affected: 8.8.0 before 11.3.11; 8.8.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1
CVE-2018-19359
8.8
2%
Apr 25
GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control
Affected: 11.3.0 before 11.3.10; 11.3.0 before 11.3.10; 11.4.0 before 11.4.6; 11.4.0 before 11.4.6; 11.4.7 through 11.4.9; 11.4.7 through 11.4.9; +24 more
CVE-2018-18646
8.8
1%
Dec 4
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3
Affected: 5.3 before 11.2.7; 5.3 before 11.2.7; 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3
CVE-2018-14603
8.8
1%
Jul 27
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2
Affected: before 10.8.7; before 10.8.7; 11.0.0 before 11.0.5; 11.0.0 before 11.0.5; 11.1.0 before 11.1.2; 11.1.0 before 11.1.2
CVE-2017-0926
8.8
1%
Mar 21
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login
Affected: 8.8.0 through 9.5.10; 8.8.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more
CVE-2017-0918
8.8
4%
Mar 21
Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution
Affected: 8.4.0 through 9.5.10; 8.4.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.15; after 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more
CVE-2017-12426
8.8
4%
Aug 14
GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4…
Affected: through 8.17.7; through 8.17.7; 9.0.0; 9.0.0; 9.0.1; 9.0.1; +34 more
CVE-2016-4340
8.8
10%
Jan 23
The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated…
Affected: 8.2.0; 8.2.1; 8.2.2; 8.2.3; 8.2.4; 8.3.0; +34 more
CVE-2026-92883
8.7
0%
Oct 13
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 19.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
CVE-2026-84739
8.7
0%
Sep 29
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 13.11 before 19.2.7; 19.3 before 19.3.3; 19.4 before 19.4.1
CVE-2026-15217
8.7
1%
Aug 12
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 18.2 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2
CVE-2026-15216
8.7
1%
Aug 12
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 18.2 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2
CVE-2026-8589
8.7
0%
Jun 11
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 13.1.4 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2
CVE-2026-10087
8.7
0%
Jun 11
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 17.1 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2
CVE-2025-12716
8.7
0%
Dec 11
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Affected: 18.4 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2
CVE-2025-4278
8.7
11%
Jun 12
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2
Affected: 18.0.0 before 18.0.2; 18.0.0 before 18.0.2
CVE-2025-1763
8.7
1%
May 30
An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting…
Affected: 16.6.0 before 17.9.7; 16.6.0 before 17.9.7; 17.10.0 before 17.10.5; 17.10.0 before 17.10.5; 17.11.0; 17.11.0
CVE-2024-11274
8.7
0%
Dec 12
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2,…
Affected: 16.1.0 before 17.4.6; 16.1.0 before 17.4.6; 17.5.0 before 17.5.4; 17.5.0 before 17.5.4; 17.6.0 before 17.6.2; 17.6.0 before 17.6.2
CVE-2024-1451
8.7
51%
Feb 22
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1
Affected: 16.9.0
CVE-2020-13340
8.7
67%
Oct 8
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log
Affected: before 13.2.10; before 13.2.10; 13.3.0 before 13.3.7; 13.3.0 before 13.3.7; 13.4.0 before 13.4.2; 13.4.0 before 13.4.2
CVE-2021-22214
8.6
28%
Jun 8
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible…
Affected: 10.5 before 13.10.5; 13.11 before 13.11.5; 13.12 before 13.12.2
CVE-2026-16301
8.5
0%
Oct 13
Incorrect Authorization in GitLab
Affected: 18.7 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
CVE-2026-79708
8.5
0%
Sep 16
Incorrect Authorization in GitLab
Affected: 19.0 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2
CVE-2026-88765
8.5
1%
Sep 15
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
Affected: 12.3 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2
CVE-2026-19228
8.5
0%
Aug 12
Authorization Bypass Through User-Controlled Key in GitLab
Affected: 19.1 before 19.1.4; 19.2 before 19.2.2
CVE-2026-15423
8.5
0%
Aug 12
Incorrect Authorization in GitLab
Affected: 19.0 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2
CVE-2026-5173
8.5
0%
Apr 8
Exposed Dangerous Method or Function in GitLab
Affected: 16.9.6 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3
CVE-2022-4037
8.5
1%
Jan 12
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2
Affected: before 15.5.7; before 15.5.7; 15.6.0 before 15.6.4; 15.6.0 before 15.6.4; 15.7.0 before 15.7.2; 15.7.0 before 15.7.2
CVE-2026-12436
8.4
0%
Jul 29
Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
Affected: 18.0 before 19.0.5; 19.1 before 19.1.3; 19.2 before 19.2.1
CVE-2020-13321
8.3
1%
Sep 30
A vulnerability was discovered in GitLab versions prior to 13.1
Affected: before 12.10.13; 13.0.0 before 13.0.8; 13.1.0 before 13.1.2
CVE-2026-15723
New
8.2
0%
Oct 21
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
Affected: 10.1 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1
CVE-2026-14814
8.2
0%
Oct 13
Permissive Regular Expression in GitLab
Affected: before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
Page 3 of 10 · 500 total
1234…10
The 500 most important CVEs for this product (exploited first, then by severity)