GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-2326 | 8.1 | Aug 5 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 Affected: >=0.0, <15.0.5; >=15.1, <15.1.4; >=15.2, <15.2.1 |
| CVE-2022-0136 | 8.1 | Mar 28 | A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 Affected: 10.5.0 through 14.5.4; 14.6 through 14.6.4; 14.7.0 through 14.7.1 |
| CVE-2021-39867 | 8.1 | Oct 5 | In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF)… Affected: 8.15.0 before 14.1.7; 8.15.0 before 14.1.7; 14.2.0 before 14.2.5; 14.2.0 before 14.2.5; 4.3.0; 4.3.0 |
| CVE-2020-13355 | 8.1 | Nov 19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 Affected: 8.14.0 before 13.3.9; 8.14.0 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2020-13299 | 8.1 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: 13.1.0 before 13.1.10; 13.1.0 before 13.1.10; 13.2.0 before 13.2.8; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4; 13.3.0 before 13.3.4 |
| CVE-2020-13291 | 8.1 | Aug 12 | In GitLab before 13.2.3, project sharing could temporarily allow too permissive access Affected: 13.2.0 before 13.2.3; 13.2.0 before 13.2.3 |
| CVE-2020-13275 | 8.1 | Jun 19 | A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 Affected: 12.2.0 before 12.9.8; 12.2.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0 |
| CVE-2020-10088 | 8.1 | Mar 13 | GitLab 12.5 through 12.8.1 has Insecure Permissions Affected: 12.5.0 through 12.8.1; 12.5.0 through 12.8.1 |
| CVE-2018-19576 | 8.1 | Jul 10 | GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make… Affected: 8.6.0 before 11.3.11; 8.6.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2019-9222 | 8.1 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2017-0921 | 8.1 | Jul 3 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in… Affected: before 10.1.6; before 10.1.6; 10.2.0 before 10.2.6; 10.2.0 before 10.2.6; 10.3.0 before 10.3.4; 10.3.0 before 10.3.4 |
| CVE-2025-12029 | 8.0 | Dec 11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 15.11 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-6948 | 8.0 | Jul 10 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could… Affected: 17.11.0 before 17.11.6; 17.11.0 before 17.11.6; 18.0.0 before 18.0.4; 18.0.0 before 18.0.4; 18.1.0 before 18.1.2; 18.1.0 before 18.1.2 |
| CVE-2024-9773 | 8.0 | Mar 27 | An issue was discovered in GitLab EE affecting all versions starting from 14.9 before 17.8.6, all versions starting from 17.9 before 17.8.3, all versions starting from 17.10… Affected: 14.9.0 before 17.8.6; 17.9.0 before 17.9.3; 17.10.0 |
| CVE-2024-0199 | 8.0 | Mar 7 | An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2 Affected: 11.3 before 16.7.7; 11.3 before 16.7.7; 16.8.0 before 16.8.4; 16.8.0 before 16.8.4; 16.9.0 before 16.9.2; 16.9.0 before 16.9.2 |
| CVE-2023-0756 | 8.0 | May 3 | An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1 Affected: before 15.9.6; 15.10 before 15.10.5; 15.11 before 15.11.1 |
| CVE-2022-4092 | 8.0 | Jan 26 | An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1 Affected: 15.6.0; 15.6.0 |
| CVE-2022-2527 | 8.0 | Oct 17 | An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all… Affected: >=15.3, <15.3.2; >=15.2, <15.2.4; >=14.9, <15.1.6 |
| CVE-2022-0154 | 8.0 | Jan 18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0… Affected: 7.7 before 14.4.5; 7.7 before 14.4.5; 14.5.0 before 14.5.3; 14.5.0 before 14.5.3; 14.6.0 before 14.6.2; 14.6.0 before 14.6.2 |
| CVE-2018-3710 | 7.8 | Mar 21 | Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution Affected: 8.9.0 through 9.5.10; 8.9.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.15; after 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-81839 | 7.7 | Oct 13 | Incorrect Authorization in GitLab Affected: 18.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2026-92470 | 7.7 | Sep 23 | Missing Authorization in GitLab Affected: 18.7 before 19.2.7; 19.3 before 19.3.3; 19.4 before 19.4.1 |
| CVE-2026-13210 | 7.7 | Sep 15 | Incorrect Authorization in GitLab Affected: 15.7 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2025-8405 | 7.7 | Dec 11 | Improper Encoding or Escaping of Output in GitLab Affected: 17.1 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-11340 | 7.7 | Oct 9 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with… Affected: 18.3.0 before 18.3.4; 18.3.0 before 18.3.4; 18.4.0 before 18.4.2; 18.4.0 before 18.4.2 |
| CVE-2025-9958 | 7.7 | Sep 26 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to… Affected: 14.10.0 before 18.2.7; 14.10.0 before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2025-1908 | 7.7 | Apr 24 | An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all… Affected: 16.6.0 before 17.9.7; 16.6.0 before 17.9.7; 17.10.0 before 17.10.5; 17.10.0 before 17.10.5; 17.11.0; 17.11.0 |
| CVE-2024-0410 | 7.7 | Feb 22 | An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1 Affected: 15.1.0 before 16.7.6; 16.8.0 before 16.8.3; 16.9.0 |
| CVE-2023-3399 | 7.7 | Nov 6 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 11.6 before 16.3.6; 16.4 before 16.4.2; 16.5 before 16.5.1 |
| CVE-2020-13323 | 7.7 | Sep 30 | A vulnerability was discovered in GitLab versions prior 13.1 Affected: 8.5.0 before 12.10.13; 13.0.0 before 13.0.8; 13.1.0 before 13.1.2 |
| CVE-2018-19571 | 7.7 | Jul 10 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks Affected: 8.18.0 before 11.3.11; 8.18.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2022-0425 | 7.6 | Apr 1 | A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery… Affected: 7.9.0 through 14.7.1; 7.9.0 through 14.7.1 |
| CVE-2020-13359 | 7.6 | Nov 19 | The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state,… Affected: 12.10.0 before 13.3.9; 12.10.0 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2026-112212 New | 7.5 | Oct 21 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab Affected: 18.3 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2025-14871 | 7.5 | Sep 16 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.4.6 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2026-1168 | 7.5 | Sep 16 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.4.6 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2026-7427 | 7.5 | Aug 12 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.5 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-15975 | 7.5 | Jul 29 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.8 before 19.0.5; 19.1 before 19.1.3; 19.2 before 19.2.1 |
| CVE-2026-12053 | 7.5 | Jun 25 | Insertion of Sensitive Information into Log File in GitLab Affected: 19.1 before 19.1.1 |
| CVE-2026-7250 | 7.5 | Jun 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.10 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2025-14869 | 7.5 | May 14 | Improper Validation of Specified Quantity in Input in GitLab Affected: 18.5 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2025-14870 | 7.5 | May 14 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.5 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-1184 | 7.5 | May 14 | Deserialization of Untrusted Data in GitLab Affected: 11.9 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-1659 | 7.5 | May 14 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 9.0 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2025-12664 | 7.5 | Apr 8 | Improper Validation of Specified Quantity in Input in GitLab Affected: 13.0 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2026-1092 | 7.5 | Apr 8 | Improper Validation of Specified Quantity in Input in GitLab Affected: 12.10 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2026-1724 | 7.5 | Mar 25 | Missing Authentication for Critical Function in GitLab Affected: 18.5 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2026-3988 | 7.5 | Mar 25 | Inefficient Algorithmic Complexity in GitLab Affected: 18.5 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-13929 | 7.5 | Mar 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 10.0 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
| CVE-2025-14513 | 7.5 | Mar 11 | Improper Validation of Specified Quantity in Input in GitLab Affected: 16.11 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
The 500 most important CVEs for this product (exploited first, then by severity)