Login Request a demo
GI
DevOps
GitLab
by GitLab · last CVE Oct 22, 2026
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
37
New 30D
Vulnerabilities1,508In the news12Timeline
Severity mix
Critical 70High 356Medium 74Low 0
Severity
All severities500Critical70High356Medium74Low0
Exploitation
On CISA KEV5Exploited in the wild5
Watch

Add GitLab to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-7968
7.5
1%
Feb 5
GitLab EE 8.0 through 12.7.2 has Incorrect Access Control
Affected: before 12.5.9; before 12.5.9; 12.6.0 before 12.6.6; 12.6.0 before 12.6.6; 12.7.0 before 12.7.4; 12.7.0 through 12.7.4
CVE-2020-7966
7.5
2%
Feb 5
GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal
Affected: 11.11.0 before 12.5.9; 12.6.0 before 12.6.6; 12.7.0 through 12.7.2
CVE-2019-5472
7.5
2%
Jan 28
An authorization issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 that prevented owners and maintainer to delete epic comments
Affected: 11.11.0 before 11.11.6; 11.11.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2
CVE-2019-5470
7.5
2%
Jan 28
An information disclosure issue was discovered GitLab versions < 12.1.2, < 12.0.4, and < 11.11.6 in the security dashboard which could result in disclosure of vulnerability…
Affected: 10.8.0 before 11.11.6; 10.8.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2
CVE-2019-15590
7.5
1%
Jan 28
An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where private merge requests and issues would be…
Affected: 12.1.0 before 12.1.14; 12.1.0 before 12.1.14; 12.2.0 before 12.2.8; 12.2.0 before 12.2.8; 12.3.0 before 12.3.5; 12.3.0 before 12.3.5
CVE-2019-15583
7.5
1%
Jan 28
An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE)
Affected: 12.1.0 before 12.1.12; 12.1.0 before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2
CVE-2019-19629
7.5
1%
Jan 5
In GitLab EE 10.5 through 12.5.3, 12.4.5, and 12.3.8, when transferring a public project to a private group, private code would be disclosed via the Group Search API provided by…
Affected: 10.5.0 through 12.3.8; 12.4.0 through 12.4.5; 12.5.0 through 12.5.3
CVE-2019-19314
7.5
1%
Jan 5
GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext
Affected: 8.4.0 before 12.3.8; 12.4.0 before 12.4.5; 12.5.0 before 12.5.2
CVE-2019-19313
7.5
1%
Jan 5
GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service
Affected: 12.3.0 before 12.3.8; 12.4.0 before 12.4.5; 12.5.0 before 12.5.2
CVE-2018-20494
7.5
2%
Dec 30
An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1
Affected: 8.4.0 before 11.4.13; 8.4.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1
CVE-2019-15576
7.5
2%
Dec 18
An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint
Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2
CVE-2019-15575
7.5
2%
Dec 18
A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope
Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2
CVE-2019-18455
7.5
2%
Nov 26
An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries
Affected: 11.0.0 through 12.4.0; 11.0.0 through 12.4.0
CVE-2019-18460
7.5
1%
Nov 26
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature provided by the Elasticsearch integration
Affected: 8.15.0 through 12.4.0; 8.15.0 through 12.4.0
CVE-2019-15729
7.5
2%
Sep 17
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1
Affected: 9.0.0 before 12.0.8; 9.0.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3
CVE-2019-15736
7.5
2%
Sep 16
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1
Affected: before 12.0.8; before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3
CVE-2019-15730
7.5
1%
Sep 16
An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1
Affected: 8.14.0 before 12.0.8; 8.14.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3
CVE-2019-15728
7.5
2%
Sep 16
An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1
Affected: 10.1.0 before 12.0.8; 10.1.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3
CVE-2019-15725
7.5
2%
Sep 16
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1
Affected: 12.0.0 before 12.0.8; 12.0.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3
CVE-2019-15722
7.5
2%
Sep 16
An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1
Affected: 8.15.0 before 12.0.8; 8.15.0 before 12.0.8; 12.1.0 before 12.1.8; 12.1.0 before 12.1.8; 12.2.0 before 12.2.3; 12.2.0 before 12.2.3
CVE-2019-6788
7.5
4%
Sep 9
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1
Affected: 8.4.0 before 11.5.8; 8.4.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1
CVE-2019-6782
7.5
2%
Sep 9
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1
Affected: 11.3.0 before 11.5.8; 11.3.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1
CVE-2019-11605
7.5
1%
Sep 9
An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.10.x before 11.10.3
Affected: 11.8.0 before 11.8.10; 11.8.0 before 11.8.10; 11.9.0 before 11.9.11; 11.9.0 before 11.9.11; 11.10.0 before 11.10.3; 11.10.0 before 11.10.3
CVE-2018-19584
7.5
2%
Jul 10
GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that allows authenticated,…
Affected: 11.0.0 before 11.3.11; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1
CVE-2018-19581
7.5
1%
Jul 10
GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that allows a Guest user…
Affected: 8.3.0 before 11.3.11; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1
CVE-2019-6797
7.5
2%
May 17
An information disclosure issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1
Affected: before 11.5.8; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1
CVE-2019-6781
7.5
1%
May 17
An Improper Input Validation issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1
Affected: 11.5.0 before 11.5.10; 11.5.0 before 11.5.10; 11.6.0 before 11.6.8; 11.6.0 before 11.6.8; 11.7.0 before 11.7.3; 11.7.0 before 11.7.3
CVE-2018-20500
7.5
1%
May 17
An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1
Affected: 9.4.0 before 11.4.13; 9.4.0 before 11.4.13; 11.5.0 before 11.5.6; 11.5.0 before 11.5.6; 11.6.0 before 11.6.1; 11.6.0 before 11.6.1
CVE-2018-19585
7.5
15%
May 17
GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Git protocol
Affected: 8.18.0 before 11.3.11; 8.18.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1
CVE-2019-10112
7.5
1%
May 16
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2
Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2
CVE-2019-10114
7.5
2%
May 16
An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2
Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2
CVE-2019-10113
7.5
2%
May 16
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2
Affected: before 11.7.8; before 11.7.8; 11.8.0 before 11.8.4; 11.8.0 before 11.8.4; 11.9.0 before 11.9.2; 11.9.0 before 11.9.2
CVE-2019-10640
7.5
2%
May 15
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4
Affected: before 11.7.10; before 11.7.10; 11.8.0 before 11.8.6; 11.8.0 before 11.8.6; 11.9.0 before 11.9.4; 11.9.0 before 11.9.4
CVE-2019-9223
7.5
2%
Apr 17
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1
Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1
CVE-2019-9220
7.5
3%
Apr 17
An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1
Affected: before 11.6.10; before 11.6.10; 11.7.0 before 11.7.6; 11.7.0 before 11.7.6; 11.8.0 before 11.8.1; 11.8.0 before 11.8.1
CVE-2018-20229
7.5
2%
Apr 4
GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal
Affected: before 11.3.14; before 11.3.14; 11.4.0 before 11.4.12; 11.4.0 before 11.4.12; 11.5.0 before 11.5.5; 11.5.0 before 11.5.5
CVE-2018-20144
7.5
2%
Mar 28
GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control
Affected: 11.0.0 before 11.3.13; 11.0.0 before 11.3.13; 11.4.0 before 11.4.11; 11.4.0 before 11.4.11; 11.5.0 before 11.5.4; 11.5.0 before 11.5.4
CVE-2018-19856
7.5
2%
Mar 26
GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API
Affected: before 11.3.12; before 11.3.12; 11.4.0 before 11.4.10; 11.4.0 before 11.4.10; 11.5.0 before 11.5.3; 11.5.0 before 11.5.3
CVE-2019-6240
7.5
2%
Mar 25
An issue was discovered in GitLab Community and Enterprise Edition before 11.4
Affected: before 11.4.0; before 11.4.0
CVE-2018-18648
7.5
1%
Dec 4
An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3
Affected: 11.2.0 before 11.2.7; 11.2.0 before 11.2.7; 11.3.0 before 11.3.8; 11.3.0 before 11.3.8; 11.4.0 before 11.4.3; 11.4.0 before 11.4.3
CVE-2018-17939
7.5
1%
Dec 4
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2
Affected: 11.1.0 before 11.1.8; 11.1.0 before 11.1.8; 11.2.0 before 11.2.5; 11.2.0 before 11.2.5; 11.3.0 before 11.3.2; 11.3.0 before 11.3.2
CVE-2018-14602
7.5
2%
Jul 27
An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2
Affected: before 10.8.7; before 10.8.7; 11.0.0 before 11.0.5; 11.0.0 before 11.0.5; 11.1.0 before 11.1.2; 11.1.0 before 11.1.2
CVE-2018-14601
7.5
1%
Jul 27
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2
Affected: 11.1.0 before 11.1.2; 11.1.0 before 11.1.2
CVE-2017-0919
7.5
1%
Jul 3
GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker…
Affected: before 10.1.6; before 10.1.6; 10.2.0 before 10.2.6; 10.2.0 before 10.2.6; 10.3.0 before 10.3.4; 10.3.0 before 10.3.4
CVE-2017-0922
7.5
1%
Mar 21
Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component resulting in an information disclosure on…
Affected: 9.1.0 through 9.5.10; 9.1.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more
CVE-2017-0914
7.5
1%
Mar 21
Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a…
Affected: 9.4.0 through 9.5.10; 9.4.0 through 9.5.10; 10.0.0 through 10.1.5; 10.0.0 through 10.1.5; 10.2.0 through 10.2.5; 10.2.0 through 10.2.5; +2 more
CVE-2026-0723
7.4
1%
Jan 22
Unchecked Return Value in GitLab
Affected: 18.6 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2
CVE-2024-8402
7.4
0%
Mar 13
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
Affected: 17.2 before 17.7.7; 17.8 before 17.8.5; 17.9 before 17.9.2
CVE-2022-2533
7.4
1%
Oct 17
An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3…
Affected: >=12.10, <15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2
CVE-2026-96893
7.3
1%
Oct 13
Improper Neutralization of Input Used for LLM Prompting in GitLab
Affected: 19.1 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
Page 8 of 10 · 500 total
1…78910
The 500 most important CVEs for this product (exploited first, then by severity)