GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-6788 | 7.5 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 8.4.0 before 11.5.8; 8.4.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1 |
| CVE-2019-6782 | 7.5 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 11.3.0 before 11.5.8; 11.3.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1 |
| CVE-2019-11605 | 7.5 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3 Affected: 11.8.0 before 11.8.10; 11.8.0 before 11.8.10; 11.9.0 before 11.9.11; 11.9.0 before 11.9.11; 11.10.0 before 11.10.3; 11.10.0 before 11.10.3 |
| CVE-2018-19584 | 7.5 | Jul 10 | GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated,… Affected: 11.0.0 before 11.3.11; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1 |
| CVE-2018-19581 | 7.5 | Jul 10 | GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user… Affected: 8.3.0 before 11.3.11; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1 |
| CVE-2019-6797 | 7.5 | May 17 | An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: before 11.5.8; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1 |
| CVE-2019-6781 | 7.5 | May 17 | An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 11.5.0 before 11.5.10; 11.5.0 before 11.5.10; 11.6.0 before 11.6.8; 11.6.0 before 11.6.8; 11.7.0 before 11.7.3; 11.7.0 before 11.7.3 |
| CVE-2018-20500 | 7.5 | May 17 | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1 Affected: 9.4.0 before 11.4.13; 9.4.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1 |
| CVE-2018-19585 | 7.5 | May 17 | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol Affected: 8.18.0 before 11.3.11; 8.18.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2019-10112 | 7.5 | May 16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2 |
| CVE-2019-10114 | 7.5 | May 16 | An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2 |
| CVE-2019-10113 | 7.5 | May 16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2 |
| CVE-2019-10640 | 7.5 | May 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4 Affected: before 11.7.10; before 11.7.10; 11.8.0 before 11.8.6; 11.8.0 before 11.8.6; 11.9.0 before 11.9.4; 11.9.0 before 11.9.4 |
| CVE-2019-9223 | 7.5 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2019-9220 | 7.5 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2018-20229 | 7.5 | Apr 4 | GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal Affected: before 11.3.14; before 11.3.14; 11.4.0 before 11.4.12; 11.4.0 before 11.4.12; 11.5.0 before 11.5.5; 11.5.0 before 11.5.5 |
| CVE-2018-20144 | 7.5 | Mar 28 | GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control Affected: 11.0.0 before 11.3.13; 11.0.0 before 11.3.13; 11.4.0 before 11.4.11; 11.4.0 before 11.4.11; 11.5.0 before 11.5.4; 11.5.0 before 11.5.4 |
| CVE-2018-19856 | 7.5 | Mar 26 | GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API Affected: before 11.3.12; before 11.3.12; 11.4.0 before 11.4.10; 11.4.0 before 11.4.10; 11.5.0 before 11.5.3; 11.5.0 before 11.5.3 |
| CVE-2019-6240 | 7.5 | Mar 25 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4 Affected: before 11.4.0; before 11.4.0 |
| CVE-2018-18648 | 7.5 | Dec 4 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3 Affected: 11.2.0 before 11.2.7; 11.2.0 before 11.2.7; 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3 |
| CVE-2018-17939 | 7.5 | Dec 4 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2 Affected: 11.1.0 before 11.1.8; 11.1.0 before 11.1.8; 11.2.0 before 11.2.5; 11.2.0 before 11.2.5; 11.3.0 before 11.3.2; 11.3.0 before 11.3.2 |
| CVE-2018-14602 | 7.5 | Jul 27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2 Affected: before 10.8.7; before 10.8.7; 11.0.0 before 11.0.5; 11.0.0 before 11.0.5; 11.1.0 before 11.1.2; 11.1.0 before 11.1.2 |
| CVE-2018-14601 | 7.5 | Jul 27 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2 Affected: 11.1.0 before 11.1.2; 11.1.0 before 11.1.2 |
| CVE-2017-0919 | 7.5 | Jul 3 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker… Affected: before 10.1.6; before 10.1.6; 10.2.0 before 10.2.6; 10.2.0 before 10.2.6; 10.3.0 before 10.3.4; 10.3.0 before 10.3.4 |
| CVE-2017-0922 | 7.5 | Mar 21 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on… Affected: 9.1.0 through 9.5.10; 9.1.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2017-0914 | 7.5 | Mar 21 | Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a… Affected: 9.4.0 through 9.5.10; 9.4.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-0723 | 7.4 | Jan 22 | Unchecked Return Value in GitLab Affected: 18.6 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2024-8402 | 7.4 | Mar 13 | An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before… Affected: 17.2.0 before 17.7.7; 17.8.0 before 17.8.5; 17.9.0 before 17.9.2 |
| CVE-2022-2533 | 7.4 | Oct 17 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3… Affected: >=12.10, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2026-96893 | 7.3 | Oct 13 | Improper Neutralization of Input Used for LLM Prompting in GitLab Affected: 19.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2022-4331 | 7.3 | Mar 9 | An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9… Affected: 15.1 before 15.7.8; 15.8 before 15.8.4; 15.9 before 15.9.2 |
| CVE-2022-3060 | 7.3 | Oct 17 | Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause… Affected: >=15.4, <15.4.1; >=15.3, <15.3.4; >=12.7, <15.2.5 |
| CVE-2022-2428 | 7.3 | Oct 17 | A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP… Affected: >=15.0, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2020-13318 | 7.3 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4 Affected: 13.0.0 before 13.0.12; 13.0.0 before 13.0.12; 13.1.0 before 13.1.10; 13.1.0 before 13.1.10; 13.2.0 before 13.2.8; 13.2.0 before 13.2.8; +2 more |
| CVE-2025-10871 | 7.2 | Sep 26 | An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 Affected: 16.6.0 before 18.2.7; 16.6.0 before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2024-8631 | 7.2 | Sep 12 | A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2 Affected: 16.6.0 before 17.1.7; 16.6.0 before 17.1.7; 17.2.0 before 17.2.5; 17.2.0 before 17.2.5; 17.3.0 before 17.3.2; 17.3.0 before 17.3.2 |
| CVE-2023-3915 | 7.2 | Sep 1 | An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3… Affected: 16.1.0 before 16.1.5; 16.1.0 before 16.1.5; 16.2 before 16.2.5; 16.2 before 16.2.5; 16.3.0; 16.3.0 |
| CVE-2021-22230 | 7.2 | Jul 7 | Improper code rendering while rendering merge requests could be exploited to submit malicious code Affected: 9.3.0 before 13.11.6; 13.12.0 before 13.12.6; 14.0.0 before 14.0.2; 9.3.0 before 13.11.6; 13.12.0 before 13.12.6; 14.0.0 before 14.0.2 |
| CVE-2021-22189 | 7.2 | Mar 4 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in… Affected: before 13.6.7; before 13.6.7; 13.7.0 before 13.7.7; 13.7.0 before 13.7.7; 13.8.0 before 13.8.4; 13.8.0 before 13.8.4 |
| CVE-2020-13322 | 7.2 | Sep 30 | A vulnerability was discovered in GitLab versions after 12.9 Affected: 12.9.0 before 12.10.13; 13.0.0 before 13.0.8; 13.1.0 before 13.1.2 |
| CVE-2020-13304 | 7.2 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13302 | 7.2 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13290 | 7.2 | Aug 12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page Affected: 8.4.0 before 13.0.12; 8.4.0 before 13.0.12; 13.1.0 before 13.1.6; 13.1.0 before 13.1.6; 13.2.0 before 13.2.3; 13.2.0 before 13.2.3 |
| CVE-2018-20499 | 7.2 | Dec 30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1 Affected: 11.0.0 before 11.4.13; 11.0.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1 |
| CVE-2019-5473 | 7.2 | Sep 9 | An authentication issue was discovered in GitLab that allowed a bypass of email verification Affected: 12.0.4; 12.1.2 |
| CVE-2017-0925 | 7.2 | Mar 21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information… Affected: 8.0.0 through 9.5.10; 8.0.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-19650 | 7.1 | Aug 17 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 18.2 before 18.11.11; 19.0 before 19.0.8; 19.1 before 19.1.6; 19.2 before 19.2.4 |
| CVE-2026-16494 | 7.1 | Aug 12 | Missing Authorization in GitLab Affected: 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2023-3922 | 7.1 | Sep 29 | An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4… Affected: 8.15 before 16.2.8; 8.15 before 16.2.8; 16.3.0 before 16.3.5; 16.3.0 before 16.3.5; 16.4.0; 16.4.0 |
| CVE-2022-1944 | 7.1 | Jun 6 | When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4,… Affected: 11.3.0 before 14.9.5; 11.3.0 before 14.9.5; 14.10.0 before 14.10.4; 14.10.0 before 14.10.4; 15.0.0; 15.0.0 |
The 500 most important CVEs for this product (exploited first, then by severity)