GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-7968 | 7.5 | Feb 5 | GitLab EE 8.0 through 12.7.2 has Incorrect Access Control Affected: before 12.5.9; before 12.5.9; 12.6.0 before 12.6.6; 12.6.0 before 12.6.6; 12.7.0 before 12.7.4; 12.7.0 through 12.7.4 |
| CVE-2020-7966 | 7.5 | Feb 5 | GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal Affected: 11.11.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 through 12.7.2 |
| CVE-2019-5472 | 7.5 | Jan 28 | An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments Affected: 11.11.0 before 11.11.6; 11.11.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2 |
| CVE-2019-5470 | 7.5 | Jan 28 | An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability… Affected: 10.8.0 before 11.11.6; 10.8.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2 |
| CVE-2019-15590 | 7.5 | Jan 28 | An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be… Affected: 12.1.0 before 12.1.14; 12.1.0 before 12.1.14; 12.2.0 before 12.2.8; 12.2.0 before 12.2.8; 12.3.0 before 12.3.5; 12.3.0 before 12.3.5 |
| CVE-2019-15583 | 7.5 | Jan 28 | An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) Affected: 12.1.0 before 12.1.12; 12.1.0 before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-19629 | 7.5 | Jan 5 | In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by… Affected: 10.5.0 through 12.3.8; 12.4.0 through 12.4.5; 12.5.0 through 12.5.3 |
| CVE-2019-19314 | 7.5 | Jan 5 | GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext Affected: 8.4.0 before 12.3.8; 12.4.0 before 12.4.5; 12.5.0 before 12.5.2 |
| CVE-2019-19313 | 7.5 | Jan 5 | GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service Affected: 12.3.0 before 12.3.8; 12.4.0 before 12.4.5; 12.5.0 before 12.5.2 |
| CVE-2018-20494 | 7.5 | Dec 30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1 Affected: 8.4.0 before 11.4.13; 8.4.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1 |
| CVE-2019-15576 | 7.5 | Dec 18 | An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-15575 | 7.5 | Dec 18 | A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-18455 | 7.5 | Nov 26 | An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries Affected: 11.0.0 through 12.4.0; 11.0.0 through 12.4.0 |
| CVE-2019-18460 | 7.5 | Nov 26 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration Affected: 8.15.0 through 12.4.0; 8.15.0 through 12.4.0 |
| CVE-2019-15729 | 7.5 | Sep 17 | An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1 Affected: 9.0.0 before 12.0.8; 9.0.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15736 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1 Affected: before 12.0.8; before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15730 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1 Affected: 8.14.0 before 12.0.8; 8.14.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15728 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1 Affected: 10.1.0 before 12.0.8; 10.1.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15725 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1 Affected: 12.0.0 before 12.0.8; 12.0.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-15722 | 7.5 | Sep 16 | An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1 Affected: 8.15.0 before 12.0.8; 8.15.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3 |
| CVE-2019-6788 | 7.5 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 8.4.0 before 11.5.8; 8.4.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1 |
| CVE-2019-6782 | 7.5 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 11.3.0 before 11.5.8; 11.3.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1 |
| CVE-2019-11605 | 7.5 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3 Affected: 11.8.0 before 11.8.10; 11.8.0 before 11.8.10; 11.9.0 before 11.9.11; 11.9.0 before 11.9.11; 11.10.0 before 11.10.3; 11.10.0 before 11.10.3 |
| CVE-2018-19584 | 7.5 | Jul 10 | GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated,… Affected: 11.0.0 before 11.3.11; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1 |
| CVE-2018-19581 | 7.5 | Jul 10 | GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user… Affected: 8.3.0 before 11.3.11; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1 |
| CVE-2019-6797 | 7.5 | May 17 | An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: before 11.5.8; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1 |
| CVE-2019-6781 | 7.5 | May 17 | An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 11.5.0 before 11.5.10; 11.5.0 before 11.5.10; 11.6.0 before 11.6.8; 11.6.0 before 11.6.8; 11.7.0 before 11.7.3; 11.7.0 before 11.7.3 |
| CVE-2018-20500 | 7.5 | May 17 | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1 Affected: 9.4.0 before 11.4.13; 9.4.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1 |
| CVE-2018-19585 | 7.5 | May 17 | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol Affected: 8.18.0 before 11.3.11; 8.18.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2019-10112 | 7.5 | May 16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2 |
| CVE-2019-10114 | 7.5 | May 16 | An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2 |
| CVE-2019-10113 | 7.5 | May 16 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2 Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2 |
| CVE-2019-10640 | 7.5 | May 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4 Affected: before 11.7.10; before 11.7.10; 11.8.0 before 11.8.6; 11.8.0 before 11.8.6; 11.9.0 before 11.9.4; 11.9.0 before 11.9.4 |
| CVE-2019-9223 | 7.5 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2019-9220 | 7.5 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2018-20229 | 7.5 | Apr 4 | GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal Affected: before 11.3.14; before 11.3.14; 11.4.0 before 11.4.12; 11.4.0 before 11.4.12; 11.5.0 before 11.5.5; 11.5.0 before 11.5.5 |
| CVE-2018-20144 | 7.5 | Mar 28 | GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control Affected: 11.0.0 before 11.3.13; 11.0.0 before 11.3.13; 11.4.0 before 11.4.11; 11.4.0 before 11.4.11; 11.5.0 before 11.5.4; 11.5.0 before 11.5.4 |
| CVE-2018-19856 | 7.5 | Mar 26 | GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API Affected: before 11.3.12; before 11.3.12; 11.4.0 before 11.4.10; 11.4.0 before 11.4.10; 11.5.0 before 11.5.3; 11.5.0 before 11.5.3 |
| CVE-2019-6240 | 7.5 | Mar 25 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4 Affected: before 11.4.0; before 11.4.0 |
| CVE-2018-18648 | 7.5 | Dec 4 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3 Affected: 11.2.0 before 11.2.7; 11.2.0 before 11.2.7; 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3 |
| CVE-2018-17939 | 7.5 | Dec 4 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2 Affected: 11.1.0 before 11.1.8; 11.1.0 before 11.1.8; 11.2.0 before 11.2.5; 11.2.0 before 11.2.5; 11.3.0 before 11.3.2; 11.3.0 before 11.3.2 |
| CVE-2018-14602 | 7.5 | Jul 27 | An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2 Affected: before 10.8.7; before 10.8.7; 11.0.0 before 11.0.5; 11.0.0 before 11.0.5; 11.1.0 before 11.1.2; 11.1.0 before 11.1.2 |
| CVE-2018-14601 | 7.5 | Jul 27 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2 Affected: 11.1.0 before 11.1.2; 11.1.0 before 11.1.2 |
| CVE-2017-0919 | 7.5 | Jul 3 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker… Affected: before 10.1.6; before 10.1.6; 10.2.0 before 10.2.6; 10.2.0 before 10.2.6; 10.3.0 before 10.3.4; 10.3.0 before 10.3.4 |
| CVE-2017-0922 | 7.5 | Mar 21 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on… Affected: 9.1.0 through 9.5.10; 9.1.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2017-0914 | 7.5 | Mar 21 | Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a… Affected: 9.4.0 through 9.5.10; 9.4.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-0723 | 7.4 | Jan 22 | Unchecked Return Value in GitLab Affected: 18.6 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2024-8402 | 7.4 | Mar 13 | An issue was discovered in GitLab EE affecting all versions starting from 17.2 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before… Affected: 17.2.0 before 17.7.7; 17.8.0 before 17.8.5; 17.9.0 before 17.9.2 |
| CVE-2022-2533 | 7.4 | Oct 17 | An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3… Affected: >=12.10, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2026-96893 | 7.3 | Oct 13 | Improper Neutralization of Input Used for LLM Prompting in GitLab Affected: 19.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
The 500 most important CVEs for this product (exploited first, then by severity)