GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
41
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-4331 | 7.3 | Mar 9 | An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9… Affected: 15.1 before 15.7.8; 15.8 before 15.8.4; 15.9 before 15.9.2 |
| CVE-2022-3060 | 7.3 | Oct 17 | Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause… Affected: >=15.4, <15.4.1; >=15.3, <15.3.4; >=12.7, <15.2.5 |
| CVE-2022-2428 | 7.3 | Oct 17 | A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP… Affected: >=15.0, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2 |
| CVE-2020-13318 | 7.3 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4 Affected: 13.0.0 before 13.0.12; 13.0.0 before 13.0.12; 13.1.0 before 13.1.10; 13.1.0 before 13.1.10; 13.2.0 before 13.2.8; 13.2.0 before 13.2.8; +2 more |
| CVE-2025-10871 | 7.2 | Sep 26 | An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 Affected: 16.6.0 before 18.2.7; 16.6.0 before 18.2.7; 18.3.0 before 18.3.3; 18.3.0 before 18.3.3; 18.4.0; 18.4.0 |
| CVE-2024-8631 | 7.2 | Sep 12 | A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2 Affected: 16.6.0 before 17.1.7; 16.6.0 before 17.1.7; 17.2.0 before 17.2.5; 17.2.0 before 17.2.5; 17.3.0 before 17.3.2; 17.3.0 before 17.3.2 |
| CVE-2023-3915 | 7.2 | Sep 1 | An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3… Affected: 16.1.0 before 16.1.5; 16.1.0 before 16.1.5; 16.2 before 16.2.5; 16.2 before 16.2.5; 16.3.0; 16.3.0 |
| CVE-2021-22230 | 7.2 | Jul 7 | Improper code rendering while rendering merge requests could be exploited to submit malicious code Affected: 9.3.0 before 13.11.6; 13.12.0 before 13.12.6; 14.0.0 before 14.0.2; 9.3.0 before 13.11.6; 13.12.0 before 13.12.6; 14.0.0 before 14.0.2 |
| CVE-2021-22189 | 7.2 | Mar 4 | Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in… Affected: before 13.6.7; before 13.6.7; 13.7.0 before 13.7.7; 13.7.0 before 13.7.7; 13.8.0 before 13.8.4; 13.8.0 before 13.8.4 |
| CVE-2020-13322 | 7.2 | Sep 30 | A vulnerability was discovered in GitLab versions after 12.9 Affected: 12.9.0 before 12.10.13; 13.0.0 before 13.0.8; 13.1.0 before 13.1.2 |
| CVE-2020-13304 | 7.2 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13302 | 7.2 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13290 | 7.2 | Aug 12 | In GitLab before 13.0.12, 13.1.6, and 13.2.3, improper access control was used on the Applications page Affected: 8.4.0 before 13.0.12; 8.4.0 before 13.0.12; 13.1.0 before 13.1.6; 13.1.0 before 13.1.6; 13.2.0 before 13.2.3; 13.2.0 before 13.2.3 |
| CVE-2018-20499 | 7.2 | Dec 30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1 Affected: 11.0.0 before 11.4.13; 11.0.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1 |
| CVE-2019-5473 | 7.2 | Sep 9 | An authentication issue was discovered in GitLab that allowed a bypass of email verification Affected: 12.0.4; 12.1.2 |
| CVE-2017-0925 | 7.2 | Mar 21 | Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration API endpoint resulting in an information… Affected: 8.0.0 through 9.5.10; 8.0.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-19650 | 7.1 | Aug 17 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 18.2 before 18.11.11; 19.0 before 19.0.8; 19.1 before 19.1.6; 19.2 before 19.2.4 |
| CVE-2026-16494 | 7.1 | Aug 12 | Missing Authorization in GitLab Affected: 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2023-3922 | 7.1 | Sep 29 | An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4… Affected: 8.15 before 16.2.8; 8.15 before 16.2.8; 16.3.0 before 16.3.5; 16.3.0 before 16.3.5; 16.4.0; 16.4.0 |
| CVE-2022-1944 | 7.1 | Jun 6 | When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4,… Affected: 11.3.0 before 14.9.5; 11.3.0 before 14.9.5; 14.10.0 before 14.10.4; 14.10.0 before 14.10.4; 15.0.0; 15.0.0 |
| CVE-2021-39944 | 7.1 | Dec 13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from… Affected: 11.0.0 before 14.3.6; 11.0.0 before 14.3.6; 14.4.0 before 14.4.4; 14.4.0 before 14.4.4; 14.5.0 before 14.5.2; 14.5.0 before 14.5.2 |
| CVE-2020-26405 | 7.1 | Nov 17 | Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations Affected: 12.8.0 before 13.3.9; 12.8.0 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2020-13325 | 7.1 | Sep 30 | A vulnerability was discovered in GitLab versions prior 13.1 Affected: 12.9.0 before 12.10.13; 13.0.0 before 13.0.8; 13.1.0 before 13.1.2 |
| CVE-2020-13293 | 7.1 | Aug 10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash Affected: 1.0.0 before 13.0.12; 13.1.0 before 13.1.6; 13.2.0 before 13.2.3 |
| CVE-2019-16170 | 7.1 | Sep 16 | An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5 Affected: 11.6.0 before 12.0.9; 11.6.0 before 12.0.9; 12.1.0 before 12.1.9; 12.1.0 before 12.1.9; 12.2.0 before 12.2.5; 12.2.0 before 12.2.5 |
| CVE-2019-6793 | 7.0 | Sep 9 | An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 10.0.0 before 11.5.8; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1 |
| CVE-2026-12664 New | 6.8 | Oct 21 | Incorrect Authorization in GitLab Affected: 18.2 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-3855 | 6.8 | Sep 16 | Improper Control of Resource Identifiers ('Resource Injection') in GitLab Affected: 18.2.7 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2025-11984 | 6.8 | Dec 11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated… Affected: 13.1.0 before 18.4.6; 13.1.0 before 18.4.6; 18.5.0 before 18.5.4; 18.5.0 before 18.5.4; 18.6.0 before 18.6.2; 18.6.0 before 18.6.2 |
| CVE-2024-12093 | 6.8 | May 22 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1 Affected: 11.1.0 before 17.10.7; 11.1.0 before 17.10.7; 17.11.0 before 17.11.3; 17.11.0 before 17.11.3; 18.0.0; 18.0.0 |
| CVE-2025-0549 | 6.8 | May 9 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2 Affected: 17.3.0 before 17.9.8; 17.3.0 before 17.9.8; 17.10.0 before 17.10.6; 17.10.0 before 17.10.6; 17.11.0 before 17.11.2; 17.11.0 before 17.11.2 |
| CVE-2024-2177 | 6.8 | Jul 9 | A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1 Affected: 16.3.0 before 16.11.5; 16.3.0 before 16.11.5; 17.0.0 before 17.0.3; 17.0.0 before 17.0.3; 17.1.0; 17.1.0 |
| CVE-2022-0123 | 6.8 | Mar 28 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1 Affected: before 14.4.5; 14.5.0 before 14.5.3; 14.6.0 before 14.6.1 |
| CVE-2024-12570 | 6.7 | Dec 12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2 Affected: 13.7.0 before 17.4.6; 13.7.0 before 17.4.6; 17.5.0 before 17.5.4; 17.5.0 before 17.5.4; 17.6.0 before 17.6.2; 17.6.0 before 17.6.2 |
| CVE-2023-6477 | 6.7 | Feb 22 | An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9… Affected: 16.5.0 before 16.7.6; 16.8.0 through 16.8.3; 16.9.0 |
| CVE-2023-6840 | 6.7 | Feb 7 | An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the… Affected: 16.4.0 before 16.6.7; 16.7.0 before 16.7.5; 16.8.0 before 16.8.2 |
| CVE-2021-39913 | 6.7 | Nov 5 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions… Affected: before 14.2.6; before 14.2.6; 14.3.0 before 14.3.4; 14.3.0 before 14.3.4 |
| CVE-2024-8266 | 6.6 | Feb 13 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project… Affected: 17.1.0 before 17.6.0; 17.1.0 before 17.6.0 |
| CVE-2026-13319 New | 6.5 | Oct 21 | Authorization Bypass Through User-Controlled Key in GitLab Affected: 15.10 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-105777 New | 6.5 | Oct 21 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 17.6.5 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-1403 | 6.5 | Oct 7 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.7 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2025-10903 | 6.5 | Aug 26 | Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab Affected: 11.10 before 19.1.7; 19.2 before 19.2.5; 19.3 before 19.3.1 |
| CVE-2026-77801 | 6.5 | Aug 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.8 before 19.1.7; 19.2 before 19.2.5; 19.3 before 19.3.1 |
| CVE-2026-1500 | 6.5 | Jun 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.10 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2026-9204 | 6.5 | Jun 11 | Server-Side Request Forgery (SSRF) in GitLab Affected: 18.10 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2026-1402 | 6.5 | May 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.1 before 18.10.7; 18.11 before 18.11.4; 19.0 before 19.0.1 |
| CVE-2026-4524 | 6.5 | May 14 | Authentication Bypass Using an Alternate Path or Channel in GitLab Affected: 18.9.1 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-4527 | 6.5 | May 14 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 11.10 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-8280 | 6.5 | May 14 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.3 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2025-0186 | 6.5 | Apr 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 10.6 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
The 500 most important CVEs for this product (exploited first, then by severity)