Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

GitLab vulnerabilities

1,178 published CVEs name GitLab among the affected products; CISA lists 6 of them as exploited in the wild.

All 1,178 in the listAtom feed of new CVEs
Published CVEs
1,178
Last 12 months
279
Critical
35
Known exploited
6

Critical 35High 239Medium 717Low 186Not scored 1

CVEs per yearBy the year they were published

  1. 201813
  2. 2020124
  3. 2021156
  4. 2022151
  5. 2023169
  6. 2024145
  7. 2025166
  8. 2026254

Known exploitedNewest addition to KEV first

  • CVE-2026-97229

    Integer Overflow or Wraparound in GitLab

    GitLab · GitLab

    ExploitedCritical10.0
  • CVE-2026-85706

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    GitLab · GitLab

    ExploitedCritical10.0
  • CVE-2021-22175

    When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5…

    GitLab · GitLab

    ExploitedMedium6.8
  • CVE-2021-39935

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all…

    GitLab · GitLab

    ExploitedMedium6.8
  • CVE-2023-7028

    Weak Password Recovery Mechanism for Forgotten Password in GitLab

    GitLab · GitLab

    ExploitedCritical10.0
  • CVE-2021-22205

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a…

    GitLab · GitLab

    ExploitedCritical10.0

Newest CVEs

  • CVE-2026-110264

    Integer Overflow or Wraparound in GitLab

    GitLab · GitLab

    Critical10.0
  • CVE-2026-12664

    Incorrect Authorization in GitLab

    GitLab · GitLab

    Medium6.8
  • CVE-2026-13319

    Authorization Bypass Through User-Controlled Key in GitLab

    GitLab · GitLab

    Medium4.3
  • CVE-2026-14288

    Use of Incorrectly-Resolved Name or Reference in GitLab

    GitLab · GitLab

    Low3.1
  • CVE-2026-15723

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab

    GitLab · GitLab

    High8.2
  • CVE-2026-16255

    Incorrect Authorization in GitLab

    GitLab · GitLab

    Medium5.9
  • CVE-2026-103515

    Incorrect Authorization in GitLab

    GitLab · GitLab

    Low2.7
  • CVE-2026-105711

    Use of Cache Containing Sensitive Information in GitLab

    GitLab · GitLab

    Low3.5
  • CVE-2026-105777

    Insertion of Sensitive Information Into Sent Data in GitLab

    GitLab · GitLab

    Medium4.3
  • CVE-2026-112378

    Use of Less Trusted Source in GitLab

    GitLab · GitLab

    Medium4.3

Products with the most CVEs

  1. GitLab1,112
  2. GitLab CE/EE22
  3. GitLab Community and Enterprise Editions13
  4. GitLab EE10
  5. GitLab Runner6
  6. GitLab AI Gateway4
  7. DAST2
  8. GitLab Community Edition2
  9. GitLab Enterprise Edition2
  10. gitlab-shell2

Most common weaknesses

  1. CWE-863 Incorrect authorization149
  2. CWE-79 Cross-site scripting (XSS)138
  3. CWE-770 Allocation of resources without limits92
  4. CWE-862 Missing authorization76
  5. CWE-400 Uncontrolled resource consumption40
  6. CWE-1333 Regular expression denial of service (ReDoS)37
  7. CWE-639 Authorization bypass through a user-controlled key (IDOR)36
  8. CWE-918 Server-side request forgery (SSRF)30
  9. CWE-200 Exposure of sensitive information25
  10. CWE-284 Improper access control19