GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,514
CVEs
6
On KEV
10.0
Max CVSS
37
New 30D
Severity mix
Critical 70High 358Medium 72Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4868 | 8.2 | May 27 | Authorization Bypass Through User-Controlled Key in GitLab Affected: 18.8 before 18.10.7; 18.11 before 18.11.4; 19.0 before 19.0.1 |
| CVE-2024-4835 | 8.2 | May 23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 15.11 before 16.10.6; 16.11 before 16.11.3; 17.0 before 17.0.1 |
| CVE-2020-13356 | 8.2 | Nov 19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9 Affected: 8.8.9 before 13.3.9; 8.8.9 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2016-9469 | 8.2 | Mar 28 | Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance Affected: 8.13.0; 8.13.0; 8.13.1; 8.13.1; 8.13.2; 8.13.2; +16 more |
| CVE-2026-18252 | 8.1 | Aug 26 | Inclusion of Functionality from Untrusted Control Sphere in GitLab Affected: 18.9 before 19.1.7; 19.2 before 19.2.5; 19.3 before 19.3.1 |
| CVE-2026-1322 | 8.1 | May 14 | Business Logic Errors in GitLab Affected: 16.0 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-4922 | 8.1 | Apr 22 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 17.0 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2026-5816 | 8.1 | Apr 22 | Improper Resolution of Path Equivalence in GitLab Affected: 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2026-2745 | 8.1 | Mar 25 | Authentication Bypass Using an Alternate Path or Channel in GitLab Affected: 7.11 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-11989 | 8.1 | Oct 26 | Missing Authorization in GitLab Affected: 17.6.0 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2024-4994 | 8.1 | Jun 20 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 16.1 before 16.11.5; 17.0.0 before 17.0.3; 17.1.0 before 17.1.1 |
| CVE-2024-8977 | 8.1 | Oct 10 | Server-Side Request Forgery (SSRF) in GitLab Affected: 15.10 before 17.2.9; 17.3 before 17.3.5; 17.4 before 17.4.2 |
| CVE-2024-8754 | 8.1 | Sep 12 | External Control of Critical State Data in GitLab Affected: 16.9.7 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-3035 | 8.1 | Aug 8 | Authorization Bypass Through User-Controlled Key in GitLab Affected: 8.12 before 17.0.6; 17.1 before 17.1.4; 17.2 before 17.2.2 |
| CVE-2024-2434 | 8.1 | Apr 25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab Affected: 16.9 before 16.9.6; 16.10 before 16.10.4; 16.11 before 16.11.1 |
| CVE-2024-1299 | 8.1 | Mar 7 | Privilege Chaining in GitLab Affected: 16.8 before 16.8.4; 16.9 before 16.9.2 |
| CVE-2023-6680 | 8.1 | Dec 15 | Improper Certificate Validation in GitLab Affected: 11.6 before 16.4.4; 16.5 before 16.5.4; 16.6 before 16.6.2 |
| CVE-2023-5332 | 8.1 | Dec 4 | Dependency on Vulnerable Third-Party Component in GitLab Affected: 9.5.0 before 16.2.8; 16.3.0 before 16.3.5; 16.4 before 16.4.1 |
| CVE-2023-0805 | 8.1 | May 3 | An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from… Affected: >=15.2, <15.9.6; >=15.10, <15.10.5; >=15.11, <15.11.1 |
| CVE-2022-4138 | 8.1 | Feb 13 | A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions… Affected: >= 1.0, <15.6.7; >=15.7, <15.7.6; >=15.8, <15.8.1 |
| CVE-2022-2326 | 8.1 | Aug 5 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 Affected: >=0.0, <15.0.5; >=15.1, <15.1.4; >=15.2, <15.2.1 |
| CVE-2022-0136 | 8.1 | Mar 28 | A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 Affected: 10.5.0 through 14.5.4; 14.6 through 14.6.4; 14.7.0 through 14.7.1 |
| CVE-2021-39867 | 8.1 | Oct 5 | In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigger Server Side Request Forgery (SSRF)… Affected: 8.15.0 before 14.1.7; 8.15.0 before 14.1.7; 14.2.0 before 14.2.5; 14.2.0 before 14.2.5; 4.3.0; 4.3.0 |
| CVE-2020-13355 | 8.1 | Nov 19 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 Affected: 8.14.0 before 13.3.9; 8.14.0 before 13.3.9; 13.4.0 before 13.4.5; 13.4.0 before 13.4.5; 13.5.0 before 13.5.2; 13.5.0 before 13.5.2 |
| CVE-2020-13299 | 8.1 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: 13.1.0 before 13.1.10; 13.1.0 before 13.1.10; 13.2.0 before 13.2.8; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4; 13.3.0 before 13.3.4 |
| CVE-2020-13291 | 8.1 | Aug 12 | In GitLab before 13.2.3, project sharing could temporarily allow too permissive access Affected: 13.2.0 before 13.2.3; 13.2.0 before 13.2.3 |
| CVE-2020-13275 | 8.1 | Jun 19 | A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 Affected: 12.2.0 before 12.9.8; 12.2.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0 |
| CVE-2020-10088 | 8.1 | Mar 13 | GitLab 12.5 through 12.8.1 has Insecure Permissions Affected: 12.5.0 through 12.8.1; 12.5.0 through 12.8.1 |
| CVE-2018-19576 | 8.1 | Jul 10 | GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make… Affected: 8.6.0 before 11.3.11; 8.6.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2019-9222 | 8.1 | Apr 17 | An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1 Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1 |
| CVE-2017-0921 | 8.1 | Jul 3 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in… Affected: before 10.1.6; before 10.1.6; 10.2.0 before 10.2.6; 10.2.0 before 10.2.6; 10.3.0 before 10.3.4; 10.3.0 before 10.3.4 |
| CVE-2025-12029 | 8.0 | Dec 11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 15.11 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-6948 | 8.0 | Jul 10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab Affected: 17.11 before 17.11.6; 18.0 before 18.0.4; 18.1 before 18.1.2 |
| CVE-2024-9773 | 8.0 | Mar 27 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab Affected: 14.9 before 17.8.6; 17.9 before 17.9.3; 17.10 before 17.10.1 |
| CVE-2024-0199 | 8.0 | Mar 7 | Incorrect Authorization in GitLab Affected: 11.3 before 16.7.7; 16.8 before 16.8.4; 16.9 before 16.9.2 |
| CVE-2023-0756 | 8.0 | May 3 | An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1 Affected: <15.9.6; >=15.10, <15.10.5; >=15.11, <15.11.1 |
| CVE-2022-4092 | 8.0 | Jan 24 | An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1 Affected: >=15.6, <15.6.1 |
| CVE-2022-2251 | 8.0 | Jan 17 | Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch… Affected: <15.3.5; >=15.4, <15.4.4; >=15.5, <15.5.2 |
| CVE-2022-2527 | 8.0 | Oct 17 | An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all… Affected: >=15.3, <15.3.2; >=15.2, <15.2.4; >=14.9, <15.1.6 |
| CVE-2022-0154 | 8.0 | Jan 18 | An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0… Affected: 7.7 before 14.4.5; 7.7 before 14.4.5; 14.5.0 before 14.5.3; 14.5.0 before 14.5.3; 14.6.0 before 14.6.2; 14.6.0 before 14.6.2 |
| CVE-2018-3710 | 7.8 | Mar 21 | Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution Affected: 8.9.0 through 9.5.10; 8.9.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.15; after 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more |
| CVE-2026-81839 | 7.7 | Oct 13 | Incorrect Authorization in GitLab Affected: 18.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| CVE-2026-92470 | 7.7 | Sep 23 | Missing Authorization in GitLab Affected: 18.7 before 19.2.7; 19.3 before 19.3.3; 19.4 before 19.4.1 |
| CVE-2026-13210 | 7.7 | Sep 15 | Incorrect Authorization in GitLab Affected: 15.7 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2025-8405 | 7.7 | Dec 11 | Improper Encoding or Escaping of Output in GitLab Affected: 17.1 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-11340 | 7.7 | Oct 9 | Incorrect Authorization in GitLab Affected: 18.3 before 18.3.4; 18.4 before 18.4.2 |
| CVE-2025-9958 | 7.7 | Sep 26 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 14.10 before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2025-1908 | 7.7 | Apr 24 | Business Logic Errors in GitLab Affected: 16.6 before 17.9.7; 17.10 before 17.10.5; 17.11 before 17.11.1 |
| CVE-2024-0410 | 7.7 | Feb 21 | Improper Enforcement of Behavioral Workflow in GitLab Affected: 15.1 before 16.7.6; 16.8 before 16.8.3; 16.9 before 16.9.1 |
| CVE-2023-3399 | 7.7 | Nov 6 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 11.6 before 16.3.6; 16.4 before 16.4.2; 16.5 before 16.5.1 |
The 500 most important CVEs for this product (exploited first, then by severity)