GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
6
On KEV
10.0
Max CVSS
37
New 30D
Severity mix
Critical 70High 357Medium 73Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-16049 | 9.8 | Oct 3 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2 Affected: 8.10.0 before 11.0.6; 8.10.0 before 11.0.6; 11.1.0 before 11.1.5; 11.1.0 before 11.1.5; 11.2.0 before 11.2.2; 11.2.0 before 11.2.2 |
| CVE-2018-14364 | 9.8 | Jul 18 | GitLab Community and Enterprise Edition before 10.7.7, 10.8.x before 10.8.6, and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code… Affected: before 10.7.7; before 10.7.7; 10.8.0 before 10.8.6; 10.8.0 before 10.8.6; 11.0 before 11.0.4; 11.0 before 11.0.4 |
| CVE-2018-8971 | 9.8 | Mar 24 | The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users Affected: through 10.3.8; 10.4.0 through 10.4.5; 10.5.0 through 10.5.5 |
| CVE-2017-0916 | 9.8 | Mar 21 | Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution Affected: 8.8.0 through 10.1.5; 8.8.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; 10.3.0 through 10.3.3; 10.3.0 through 10.3.3 |
| CVE-2017-0915 | 9.8 | Mar 21 | Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution Affected: 8.9.0 through 9.5.10; 8.9.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-75871 | 9.6 | Aug 27 | Server-Side Request Forgery (SSRF) in GitLab AI Gateway Affected: 18.10.0 before 19.0.12; 19.1.0 before 19.1.7; 19.2.0 before 19.2.2 |
| CVE-2025-13761 | 9.6 | Jan 9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 18.6 before 18.6.3; 18.7 before 18.7.1 |
| CVE-2025-9642 | 9.6 | Sep 26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 14.10 before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2020-13292 | 9.6 | Aug 10 | In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow Affected: 12.3.0 before 13.0.12; 13.1.0 before 13.1.6; 13.2.0 before 13.2.3 |
| CVE-2026-19478 | 9.1 | Aug 17 | Improper Control of Generation of Code ('Code Injection') in GitLab Affected: 18.2 before 18.11.11; 19.0 before 19.0.8; 19.1 before 19.1.6; 19.2 before 19.2.4 |
| CVE-2025-7659 | 9.1 | Feb 11 | Origin Validation Error in GitLab Affected: 18.2 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2023-3441 | 9.1 | Oct 1 | Exposure of Sensitive Information Due to Incompatible Policies in GitLab Affected: 8.0 before 16.4 |
| CVE-2024-2743 | 9.1 | Sep 12 | Incorrect Authorization in GitLab Affected: 13.3 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2022-0249 | 9.1 | Mar 28 | A vulnerability was discovered in GitLab starting with version 12 Affected: 12.0 through 14.5.4; 14.6 through 14.6.4; 14.7 through 14.7.1 |
| CVE-2020-13347 | 9.1 | Oct 7 | A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1 Affected: 12.0.0 before 13.2.4; 12.0.0 before 13.2.4; 13.3.0 before 13.3.2; 13.3.0 before 13.3.2; 13.4.0 before 13.4.1; 13.4.0 before 13.4.1 |
| CVE-2020-10083 | 9.1 | Mar 13 | GitLab 12.7 through 12.8.1 has Insecure Permissions Affected: 12.7.0 through 12.8.1; 12.7.0 through 12.8.1 |
| CVE-2019-7353 | 9.1 | May 17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 11.7.x before 11.7.4 Affected: 11.7.0 before 11.7.4; 11.7.0 before 11.7.4 |
| CVE-2019-5883 | 9.1 | May 17 | An Incorrect Access Control issue was discovered in GitLab Community and Enterprise Edition 6.0 and later but before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 Affected: 6.0.0 before 11.3.11; 6.0.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2019-9890 | 9.1 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: 10.0.0 before 11.6.10; 10.0.0 before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2026-16627 | 9.0 | Aug 12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 19.2 before 19.2.2 |
| CVE-2022-3726 | 9.0 | Nov 10 | Lack of sand-boxing of OpenAPI documents in GitLab CE/EE affecting all versions from 12.6 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to… Affected: 12.6.0 before 15.3.5; 12.6.0 before 15.3.5; 15.4.0 before 15.4.4; 15.4.0 before 15.4.4; 15.5.0 before 15.5.2; 15.5.0 before 15.5.2 |
| CVE-2026-10053 | 8.8 | Aug 23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab Affected: 18.8 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-2370 | 8.8 | Mar 29 | Improper Handling of Parameters in GitLab Affected: 14.3 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2026-3857 | 8.8 | Mar 25 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 17.10 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-11702 | 8.8 | Oct 29 | Missing Authorization in GitLab Affected: 17.1 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-7691 | 8.8 | Sep 26 | Privilege Defined With Unsafe Actions in GitLab Affected: 16.6 before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2025-6454 | 8.8 | Sep 12 | Server-Side Request Forgery (SSRF) in GitLab Affected: 16.11 before 18.1.6; 18.2 before 18.2.6; 18.3 before 18.3.2 |
| CVE-2025-2938 | 8.8 | Jun 26 | Business Logic Errors in GitLab Affected: 17.3 before 17.11.5; 18.0 before 18.0.3; 18.1 before 18.1.1 |
| CVE-2025-2242 | 8.8 | Mar 27 | Incorrect Authorization in GitLab Affected: 17.4 before 17.8.6; 17.9 before 17.9.3; 17.10 before 17.10.1 |
| CVE-2024-9870 | 8.8 | Feb 12 | Unintended Proxy or Intermediary ('Confused Deputy') in GitLab Affected: 15.11 before 17.6.5; 17.7 before 17.7.4; 17.8 before 17.8.2 |
| CVE-2024-1211 | 8.8 | Jan 30 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 10.6 before 16.9.7; 16.10 before 16.10.5; 16.11 before 16.11.2 |
| CVE-2024-8114 | 8.8 | Nov 26 | Missing Authorization in GitLab Affected: 8.12 before 17.4.5; 17.5 before 17.5.3; 17.6 before 17.6.1 |
| CVE-2024-9693 | 8.8 | Nov 14 | Incorrect Authorization in GitLab Affected: 16.0 before 17.3.7; 17.4.0 before 17.4.4; 17.5.0 before 17.5.2 |
| CVE-2024-8970 | 8.8 | Oct 11 | Incorrect Authorization in GitLab Affected: 11.6 before 17.2.9; 17.3 before 17.3.5; 17.4 before 17.4.2 |
| CVE-2024-9164 | 8.8 | Oct 11 | Missing Authentication for Critical Function in GitLab Affected: 12.5 before 17.2.9; 17.3 before 17.3.5; 17.4 before 17.4.2 |
| CVE-2024-6678 | 8.8 | Sep 12 | Authentication Bypass by Spoofing in GitLab Affected: 8.14 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-8641 | 8.8 | Sep 12 | Privilege Context Switching Error in GitLab Affected: 13.7 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-8640 | 8.8 | Sep 12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab Affected: 16.11 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-5655 | 8.8 | Jun 26 | Improper Access Control in GitLab Affected: 15.8 before 16.11.5; 17.0 before 17.0.3; 17.1 before 17.1.1 |
| CVE-2024-4024 | 8.8 | Apr 25 | Authentication Bypass by Assumed-Immutable Data in GitLab Affected: 7.8 before 16.9.6; 16.10 before 16.10.4; 16.11 before 16.11.1 |
| CVE-2023-5356 | 8.8 | Jan 12 | Incorrect Authorization in GitLab Affected: 8.13 before 16.5.6; 16.6 before 16.6.4; 16.7 before 16.7.2 |
| CVE-2023-3907 | 8.8 | Dec 17 | Improper User Management in GitLab Affected: 16.0 before 16.4.4; 16.5 before 16.5.4; 16.6 before 16.6.2 |
| CVE-2023-5207 | 8.8 | Sep 30 | A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 Affected: 16.0.0 before 16.2.8; 16.0.0 before 16.2.8; 16.3.0 before 16.3.5; 16.3.0 before 16.3.5; 16.4.0; 16.4.0 |
| CVE-2023-2182 | 8.8 | May 3 | An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1 Affected: 15.10.0 before 15.10.5; 15.11.0 |
| CVE-2018-17451 | 8.8 | Apr 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 Affected: before 11.1.7; before 11.1.7; 11.2.0 before 11.2.4; 11.2.0 before 11.2.4; 11.3.0; 11.3.0 |
| CVE-2022-2185 | 8.8 | Jul 1 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated… Affected: 14.0.0 before 14.10.5; 14.0.0 before 14.10.5; 15.0.0 before 15.0.4; 15.0.0 before 15.0.4; 15.1.0; 15.1.0 |
| CVE-2022-1680 | 8.8 | Jun 6 | An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions… Affected: 11.10.0 before 14.9.5; 14.10.0 before 14.10.4; 15.0.0 |
| CVE-2022-1423 | 8.8 | May 19 | Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all… Affected: 1.0.2 before 14.8.6; 1.0.2 before 14.8.6; 14.9.0 before 14.9.4; 14.9.0 before 14.9.4; 14.10.0; 14.10.0 |
| CVE-2022-0751 | 8.8 | Mar 28 | Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick… Affected: 10.0 before 14.6.5; 10.0 before 14.6.5; 14.7 before 14.7.4; 14.7 before 14.7.4; 14.8 before 14.8.2; 14.8 before 14.8.2 |
| CVE-2022-0427 | 8.8 | Mar 28 | Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a… Affected: 14.5 before 14.5.4; 14.5 before 14.5.4; 14.6 before 14.6.4; 14.6 before 14.6.4; 14.7 before 14.7.1; 14.7 before 14.7.1 |
The 500 most important CVEs for this product (exploited first, then by severity)