GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1069 | 7.5 | Mar 11 | Uncontrolled Recursion in GitLab Affected: 18.9 before 18.9.2 |
| CVE-2025-14511 | 7.5 | Feb 25 | Improper Validation of Specified Quantity in Input in GitLab Affected: 12.2 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1388 | 7.5 | Feb 25 | Inefficient Regular Expression Complexity in GitLab Affected: 9.2 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1662 | 7.5 | Feb 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 14.4 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1725 | 7.5 | Feb 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.9 before 18.9.1 |
| CVE-2025-8099 | 7.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 10.8 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2026-0958 | 7.5 | Feb 11 | Interpretation Conflict in GitLab Affected: 18.4 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2026-1456 | 7.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2026-1458 | 7.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.0 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2025-13928 | 7.5 | Jan 22 | Incorrect Authorization in GitLab Affected: 17.7 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2025-13927 | 7.5 | Jan 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.9 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2026-1102 | 7.5 | Jan 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.3 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2025-12562 | 7.5 | Dec 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.10 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-12571 | 7.5 | Nov 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.10 before 18.4.5; 18.5 before 18.5.3; 18.6 before 18.6.1 |
| CVE-2025-10497 | 7.5 | Oct 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.10 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-11447 | 7.5 | Oct 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.0 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-10004 | 7.5 | Oct 9 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 13.12 before 18.2.8; 18.3 before 18.3.4; 18.4 before 18.4.2 |
| CVE-2025-8014 | 7.5 | Sep 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.10 before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2025-11042 | 7.5 | Sep 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.2 before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2025-10858 | 7.5 | Sep 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2025-2256 | 7.5 | Sep 12 | Improper Validation of Specified Quantity in Input in GitLab Affected: 7.12 before 18.1.6; 18.2 before 18.2.6; 18.3 before 18.3.2 |
| CVE-2025-4225 | 7.5 | Aug 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 14.1 before 18.1.5; 18.2 before 18.2.5; 18.3 before 18.3.1 |
| CVE-2025-1477 | 7.5 | Aug 13 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.14 before 18.0.6; 18.1 before 18.1.4; 18.2 before 18.2.2 |
| CVE-2024-4025 | 7.5 | Jun 20 | Inefficient Regular Expression Complexity in GitLab Affected: 7.10 before 16.11.5; 17.0 before 17.0.3; 17.1 before 17.1.1 |
| CVE-2024-7586 | 7.5 | Jun 20 | Insertion of Sensitive Information into Log File in GitLab Affected: 17.0 before 17.0.6; 17.1 before 17.1.4; 17.2 before 17.2.2 |
| CVE-2025-5982 | 7.5 | Jun 12 | Insufficient Granularity of Access Control in GitLab Affected: 12.0 before 17.10.8; 17.11 before 17.11.4; 18.0 before 18.0.2 |
| CVE-2025-0673 | 7.5 | Jun 12 | Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab Affected: 17.7 before 17.10.8; 17.11 before 17.11.4; 18.0 before 18.0.2 |
| CVE-2025-1478 | 7.5 | Jun 12 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.13 before 17.10.8; 17.11 before 17.11.4; 18.0 before 18.0.2 |
| CVE-2025-1516 | 7.5 | Jun 12 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.7 before 17.10.8; 17.11 before 17.11.4; 18.0 before 18.0.2 |
| CVE-2024-9163 | 7.5 | May 23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a… Affected: 12.1.0 before 17.10.7; 12.1.0 before 17.10.7; 17.11.0 before 17.11.3; 17.11.0 before 17.11.3; 18.0.0; 18.0.0 |
| CVE-2024-7803 | 7.5 | May 23 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1 Affected: 11.6.0 before 17.10.7; 11.6.0 before 17.10.7; 17.11.0 before 17.11.3; 17.11.0 before 17.11.3; 18.0.0; 18.0.0 |
| CVE-2025-4979 | 7.5 | May 22 | An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1 Affected: before 17.10.7; before 17.10.7; 17.11.0 before 17.11.3; 17.11.0 before 17.11.3; 18.0.0; 18.0.0 |
| CVE-2025-1278 | 7.5 | May 9 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2 Affected: 12.0.0 before 17.9.8; 12.0.0 before 17.9.8; 17.10.0 before 17.10.6; 17.10.0 before 17.10.6; 17.11.0 before 17.11.2; 17.11.0 before 17.11.2 |
| CVE-2024-8973 | 7.5 | May 9 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2 Affected: 17.1.0 before 17.9.8; 17.1.0 before 17.9.8; 17.10.0 before 17.10.6; 17.10.0 before 17.10.6; 17.11.0 before 17.11.2; 17.11.0 before 17.11.2 |
| CVE-2025-0639 | 7.5 | Apr 24 | An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11… Affected: 16.7.0 before 17.9.7; 16.7.0 before 17.9.7; 17.10.0 before 17.10.5; 17.10.0 before 17.10.5; 17.11.0; 17.11.0 |
| CVE-2025-1677 | 7.5 | Apr 10 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur… Affected: through 17.8.7; through 17.8.7; 17.9.0 before 17.9.6; 17.9.0 before 17.9.6; 17.10.0 before 17.10.4; 17.10.0 before 17.10.4 |
| CVE-2024-11129 | 7.5 | Apr 10 | An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4 Affected: 17.1.0 before 17.8.6; 17.1.0 before 17.8.7; 17.9.0 before 17.9.6; 17.9.0 before 17.9.6; 17.10.0 before 17.10.4; 17.10.0 before 17.10.4 |
| CVE-2025-1257 | 7.5 | Mar 13 | An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2 Affected: 12.3.0 before 17.7.7; 17.8.0 before 17.8.5; 17.9.0 before 17.9.2 |
| CVE-2024-12380 | 7.5 | Mar 13 | An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9… Affected: 11.5.0 before 17.7.7; 11.5.0 before 17.7.7; 17.8.0 before 17.8.5; 17.8.0 before 17.8.5; 17.9.0 before 17.9.2; 17.9.0 before 17.9.2 |
| CVE-2024-7102 | 7.5 | Feb 13 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain… Affected: 16.4.0 before 17.5.0; 16.4.0 before 17.5.0 |
| CVE-2025-1212 | 7.5 | Feb 12 | An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send… Affected: 8.3.0 before 17.6.5; 8.3.0 before 17.6.5; 17.7.0 before 17.7.4; 17.7.0 before 17.7.4; 17.8.0 before 17.8.2; 17.8.0 before 17.8.2 |
| CVE-2025-1042 | 7.5 | Feb 12 | An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker… Affected: 15.7.0 before 17.6.5; 17.7.0 before 17.7.4; 17.8.0 before 17.8.2 |
| CVE-2024-2878 | 7.5 | Feb 5 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to… Affected: 15.7.0 before 16.9.7; 15.7.0 before 16.9.7; 16.10.0 before 16.10.5; 16.10.0 before 16.10.5; 16.11.0 before 16.11.2; 16.11.0 before 16.11.2 |
| CVE-2024-9631 | 7.5 | Feb 5 | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2,… Affected: 13.6.0 before 17.2.9; 13.6.0 before 17.2.9; 17.3.0 before 17.3.5; 17.3.0 before 17.3.5; 17.4.0 before 17.4.2; 17.4.0 before 17.4.2 |
| CVE-2023-6386 | 7.5 | Feb 5 | A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an… Affected: 15.11.0 before 16.6.7; 15.11.0 before 16.6.7; 16.7.0 before 16.7.5; 16.7.0 before 16.7.5; 16.8.0 before 16.8.2; 16.8.0 before 16.8.2 |
| CVE-2024-8233 | 7.5 | Dec 12 | An issue has been discovered in GitLab CE/EE affecting all versions from 9.4 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2 Affected: 9.4.0 before 17.4.6; 9.4.0 before 17.4.6; 17.5.0 before 17.5.4; 17.5.0 before 17.5.4; 17.6.0 before 17.6.2; 17.6.0 before 17.6.2 |
| CVE-2024-8237 | 7.5 | Nov 26 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1 Affected: 12.6.0 before 17.4.5; 12.6.0 before 17.4.5; 17.5.0 before 17.5.3; 17.5.0 before 17.5.3; 17.6.0; 17.6.0 |
| CVE-2024-8177 | 7.5 | Nov 26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which… Affected: 15.6.0 before 17.4.5; 15.6.0 before 17.4.5; 17.5.0 before 17.5.3; 17.5.0 before 17.5.3; 17.6.0; 17.6.0 |
| CVE-2024-11828 | 7.5 | Nov 26 | A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1 Affected: 13.2.4 before 17.4.5; 13.2.4 before 17.4.5; 17.5.0 before 17.5.3; 17.5.0 before 17.5.3; 17.6.0; 17.6.0 |
| CVE-2024-11669 | 7.5 | Nov 26 | An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1 Affected: 16.9.8 before 17.4.5; 16.9.8 before 17.4.5; 17.5.0 before 17.5.3; 17.5.0 before 17.5.3; 17.6.0; 17.6.0 |
The 500 most important CVEs for this product (exploited first, then by severity)