GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-19571 | 7.7 | Jul 10 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks Affected: 8.18.0 before 11.3.11; 8.18.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2022-0425 | 7.6 | Apr 1 | A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery… Affected: 7.9.0 through 14.7.1; 7.9.0 through 14.7.1 |
| CVE-2020-13359 | 7.6 | Nov 19 | The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state,… Affected: 12.10.0 before 13.3.9; 12.10.0 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2026-112212 New | 7.5 | Oct 21 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab Affected: 18.3 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2025-14871 | 7.5 | Sep 16 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.4.6 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2026-1168 | 7.5 | Sep 16 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.4.6 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2026-7427 | 7.5 | Aug 12 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.5 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-15975 | 7.5 | Jul 29 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.8 before 19.0.5; 19.1 before 19.1.3; 19.2 before 19.2.1 |
| CVE-2026-12053 | 7.5 | Jun 25 | Insertion of Sensitive Information into Log File in GitLab Affected: 19.1 before 19.1.1 |
| CVE-2026-7250 | 7.5 | Jun 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.10 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2025-14869 | 7.5 | May 14 | Improper Validation of Specified Quantity in Input in GitLab Affected: 18.5 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2025-14870 | 7.5 | May 14 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.5 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-1184 | 7.5 | May 14 | Deserialization of Untrusted Data in GitLab Affected: 11.9 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-1659 | 7.5 | May 14 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 9.0 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2025-12664 | 7.5 | Apr 8 | Improper Validation of Specified Quantity in Input in GitLab Affected: 13.0 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2026-1092 | 7.5 | Apr 8 | Improper Validation of Specified Quantity in Input in GitLab Affected: 12.10 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2026-1724 | 7.5 | Mar 25 | Missing Authentication for Critical Function in GitLab Affected: 18.5 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2026-3988 | 7.5 | Mar 25 | Inefficient Algorithmic Complexity in GitLab Affected: 18.5 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-13929 | 7.5 | Mar 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 10.0 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
| CVE-2025-14513 | 7.5 | Mar 11 | Improper Validation of Specified Quantity in Input in GitLab Affected: 16.11 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
| CVE-2026-1069 | 7.5 | Mar 11 | Uncontrolled Recursion in GitLab Affected: 18.9 before 18.9.2 |
| CVE-2025-14511 | 7.5 | Feb 25 | Improper Validation of Specified Quantity in Input in GitLab Affected: 12.2 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1388 | 7.5 | Feb 25 | Inefficient Regular Expression Complexity in GitLab Affected: 9.2 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1662 | 7.5 | Feb 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 14.4 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1725 | 7.5 | Feb 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.9 before 18.9.1 |
| CVE-2025-8099 | 7.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 10.8 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2026-0958 | 7.5 | Feb 11 | Interpretation Conflict in GitLab Affected: 18.4 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2026-1456 | 7.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2026-1458 | 7.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.0 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2025-13928 | 7.5 | Jan 22 | Incorrect Authorization in GitLab Affected: 17.7 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2025-13927 | 7.5 | Jan 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.9 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2026-1102 | 7.5 | Jan 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.3 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2025-12562 | 7.5 | Dec 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.10 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-12571 | 7.5 | Nov 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.10 before 18.4.5; 18.5 before 18.5.3; 18.6 before 18.6.1 |
| CVE-2025-10497 | 7.5 | Oct 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.10 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-11447 | 7.5 | Oct 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.0 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-10004 | 7.5 | Oct 9 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or… Affected: 13.12.0 before 18.2.8; 13.12.0 before 18.2.8; 18.3.0 before 18.3.4; 18.3.0 before 18.3.4; 18.4.0 before 18.4.2; 18.4.0 before 18.4.2 |
| CVE-2025-8014 | 7.5 | Sep 27 | Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows… Affected: 11.10.0 before 18.2.7; 11.10.0 before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2025-11042 | 7.5 | Sep 26 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause… Affected: 17.2.0 before 18.2.7; 17.2.0 before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2025-10858 | 7.5 | Sep 26 | An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of… Affected: before 18.2.7; before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2025-2256 | 7.5 | Sep 12 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users… Affected: 7.12.0 before 18.1.6; 7.12.0 before 18.1.6; 18.2.0 before 18.2.6; 18.2.0 before 18.2.6; 18.3.0 before 18.3.2; 18.3.0 before 18.3.2 |
| CVE-2025-4225 | 7.5 | Aug 27 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could… Affected: 14.1.0 before 18.1.5; 14.1.0 before 18.1.5; 18.2.0 before 18.2.5; 18.2.0 before 18.2.5; 18.3.0; 18.3.0 |
| CVE-2025-1477 | 7.5 | Aug 13 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated… Affected: 8.1.4 before 18.0.6; 8.1.4 before 18.0.6; 18.1.0 before 18.1.4; 18.1.0 before 18.1.4; 18.2.0 before 18.2.2; 18.2.0 before 18.2.2 |
| CVE-2024-4025 | 7.5 | Jun 20 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1 Affected: 7.10.0 before 16.11.5; 7.10.0 before 16.11.5; 17.0.0 before 17.0.3; 17.0.0 before 17.0.3; 17.1.0; 17.1.0 |
| CVE-2024-7586 | 7.5 | Jun 20 | An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where… Affected: 17.0.0 before 17.0.6; 17.0.0 before 17.0.6; 17.1.0 before 17.1.4; 17.1.0 before 17.1.4; 17.2.0 before 17.2.2; 17.2.0 before 17.2.2 |
| CVE-2025-5982 | 7.5 | Jun 12 | An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 Affected: 12.0.0 before 17.10.8; 17.11.0 before 17.11.4; 18.0.0 before 18.0.2 |
| CVE-2025-0673 | 7.5 | Jun 12 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an… Affected: 17.7.0 before 17.10.8; 17.7.0 before 17.10.8; 17.11.0 before 17.11.4; 17.11.0 before 17.11.4; 18.0.0 before 18.0.2; 18.0.0 before 18.0.2 |
| CVE-2025-1516 | 7.5 | Jun 12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2 Affected: 8.7.0 before 17.10.8; 8.7.0 before 17.10.8; 17.11.0 before 17.11.4; 17.11.0 before 17.11.4; 18.0.0 before 18.0.2; 18.0.0 before 18.0.2 |
| CVE-2025-1478 | 7.5 | Jun 12 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1 Affected: 8.13.0 before 17.10.7; 8.13.0 before 17.10.7; 17.11.0 before 17.11.3; 17.11.0 before 17.11.3; 18.0.0; 18.0.0 |
| CVE-2024-9163 | 7.5 | May 23 | A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a… Affected: 12.1.0 before 17.10.7; 12.1.0 before 17.10.7; 17.11.0 before 17.11.3; 17.11.0 before 17.11.3; 18.0.0; 18.0.0 |
The 500 most important CVEs for this product (exploited first, then by severity)