Skip to contentGitlab vulnerabilities
Newest
- gitlabTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabCVE-2024-11222Fix available6.4 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLabCVE-2025-14871Fix available7.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLabCVE-2026-1168Fix available7.5 High
- gitlabImproper Control of Resource Identifiers ('Resource Injection') in GitLabCVE-2026-3855Fix available3.1 Low
- gitlabMissing Authorization in GitLabCVE-2026-7514Fix available4.3 Medium
- gitlabMissing Authorization in GitLabCVE-2026-8030Fix available4.3 Medium
- gitlabMissing Authorization in GitLabCVE-2026-16794Fix available4.3 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2026-19619Fix available4.7 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2026-78252Fix available8.2 High
- gitlabIncorrect Authorization in GitLabCVE-2026-79708Fix available8.5 High
- gitlabMissing Authentication for Critical Function in GitLabCVE-2026-12910Fix available5.4 Medium
- gitlabIncorrect Authorization in GitLabCVE-2026-13210Fix available7.7 High
- gitlabInsertion of Sensitive Information Into Sent Data in GitLabCVE-2026-82837Fix available5.3 Medium
- gitlabImproper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabCVE-2026-88765Fix available8.5 High
- gitlab, gitlab community edition and enterprise edition +1 moreImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabCVE-2026-85706In KEVPublic exploitFix availableEPSS 97.4%10.0 Critical
- gitlabDeserialization of Untrusted Data in GitLabCVE-2026-87719Fix available9.9 Critical
- gitlab, gitlab ai gateway +1 moreServer-Side Request Forgery (SSRF) in GitLab AI GatewayCVE-2026-758718.2 High
- gitlab ai gatewayServer-Side Request Forgery (SSRF) in GitLab AI GatewayCVE-2026-198898.2 High
- gitlabLoop with Unreachable Exit Condition ('Infinite Loop') in GitLabCVE-2025-10903Fix available6.5 Medium
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLabCVE-2026-3035Fix available5.5 Medium
- gitlabAccess Control Check Implemented After Asset is Accessed in GitLabCVE-2026-7487Fix available3.5 Low
- gitlabAcceptance of Extraneous Untrusted Data With Trusted Data in GitLabCVE-2026-15387Fix available4.3 Medium
- gitlabInclusion of Functionality from Untrusted Control Sphere in GitLabCVE-2026-18252Fix available7.3 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLabCVE-2026-77801Fix available6.5 Medium
- gitlabImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabCVE-2026-10053Public exploitFix available8.5 High
- gitlabCross-Site Request Forgery (CSRF) in GitLabCVE-2026-19650Public exploitFix available7.1 High
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLabCVE-2026-19478Public exploitFix available9.4 Critical
- gitlabIncorrect Privilege Assignment in GitLabCVE-2025-9486Fix available3.3 Low
- gitlabMissing Authorization in GitLabCVE-2026-4879Fix available4.3 Medium
- gitlabMissing Authorization in GitLabCVE-2026-6821Fix available4.3 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2026-15217Fix available8.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2026-15216Fix available8.7 High
- gitlabMissing Authorization in GitLabCVE-2026-16494Fix available7.1 High
- gitlabIncorrect Authorization in GitLabCVE-2026-18433Fix available4.3 Medium
- gitlabAuthorization Bypass Through User-Controlled Key in GitLabCVE-2026-19228Fix available8.5 High
- gitlabAllocation of Resources Without Limits or Throttling in GitLabCVE-2026-7427Fix available5.3 Medium
- gitlabIncorrect Authorization in GitLabCVE-2026-8667Fix available4.3 Medium
- gitlabIncorrect Authorization in GitLabCVE-2026-15423Fix available8.5 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2026-16627Fix available7.7 High
- gitlabMissing Authorization in GitLabCVE-2026-18244Fix available4.3 Medium
- gitlabIncorrect Authorization in GitLabCVE-2025-14562Fix available3.1 Low
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2026-3093Fix available4.7 Medium
- gitlabMissing Authorization in GitLabCVE-2026-4672Fix available4.3 Medium
- gitlabInsertion of Sensitive Information Into Sent Data in GitLabCVE-2026-6267Fix available8.5 High
- gitlabIncorrect Authorization in GitLabCVE-2026-6336Fix available5.3 Medium
- gitlabImproperly Controlled Modification of Dynamically-Determined Object Attributes in GitLabCVE-2026-12436Fix available8.4 High
- gitlabTime-of-check Time-of-use (TOCTOU) Race Condition in GitLabCVE-2026-13113Fix available6.5 Medium
- gitlabMissing Authorization in GitLabCVE-2026-14341Fix available4.9 Medium
- gitlabExposure of Sensitive Information Through Metadata in GitLabCVE-2026-14351Fix available4.3 Medium
- gitlabImproper Neutralization of Input Used for LLM Prompting in GitLabCVE-2026-15077Fix available4.3 Medium
- Show moreLoading…