GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
5
On KEV
10.0
Max CVSS
37
New 30D
Severity mix
Critical 70High 356Medium 74Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-39935 In wildKEV | 7.5 | Dec 13 | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability Affected: >=10.5, <14.3.6; >=14.4, <14.4.4; >=14.5, <14.5.2 |
| CVE-2026-10053 | 8.8 | Aug 23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab Affected: 18.8 before 19.0.6; 19.1 before 19.1.4; 19.2 before 19.2.2 |
| CVE-2026-2370 | 8.8 | Mar 29 | Improper Handling of Parameters in GitLab Affected: 14.3 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2026-3857 | 8.8 | Mar 25 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 17.10 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-11702 | 8.8 | Oct 29 | Missing Authorization in GitLab Affected: 17.1 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-7691 | 8.8 | Sep 26 | Privilege Defined With Unsafe Actions in GitLab Affected: 16.6 before 18.2.7; 18.3 before 18.3.3; 18.4 before 18.4.1 |
| CVE-2025-6454 | 8.8 | Sep 12 | Server-Side Request Forgery (SSRF) in GitLab Affected: 16.11 before 18.1.6; 18.2 before 18.2.6; 18.3 before 18.3.2 |
| CVE-2025-2938 | 8.8 | Jun 26 | Business Logic Errors in GitLab Affected: 17.3 before 17.11.5; 18.0 before 18.0.3; 18.1 before 18.1.1 |
| CVE-2025-2242 | 8.8 | Mar 27 | Incorrect Authorization in GitLab Affected: 17.4 before 17.8.6; 17.9 before 17.9.3; 17.10 before 17.10.1 |
| CVE-2024-9870 | 8.8 | Feb 12 | Unintended Proxy or Intermediary ('Confused Deputy') in GitLab Affected: 15.11 before 17.6.5; 17.7 before 17.7.4; 17.8 before 17.8.2 |
| CVE-2024-1211 | 8.8 | Jan 30 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 10.6 before 16.9.7; 16.10 before 16.10.5; 16.11 before 16.11.2 |
| CVE-2024-8114 | 8.8 | Nov 26 | Missing Authorization in GitLab Affected: 8.12 before 17.4.5; 17.5 before 17.5.3; 17.6 before 17.6.1 |
| CVE-2024-9693 | 8.8 | Nov 14 | Incorrect Authorization in GitLab Affected: 16.0 before 17.3.7; 17.4.0 before 17.4.4; 17.5.0 before 17.5.2 |
| CVE-2024-8970 | 8.8 | Oct 11 | Incorrect Authorization in GitLab Affected: 11.6 before 17.2.9; 17.3 before 17.3.5; 17.4 before 17.4.2 |
| CVE-2024-9164 | 8.8 | Oct 11 | Missing Authentication for Critical Function in GitLab Affected: 12.5 before 17.2.9; 17.3 before 17.3.5; 17.4 before 17.4.2 |
| CVE-2024-6678 | 8.8 | Sep 12 | Authentication Bypass by Spoofing in GitLab Affected: 8.14 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-8641 | 8.8 | Sep 12 | Privilege Context Switching Error in GitLab Affected: 13.7 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-8640 | 8.8 | Sep 12 | Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab Affected: 16.11 before 17.1.7; 17.2 before 17.2.5; 17.3 before 17.3.2 |
| CVE-2024-5655 | 8.8 | Jun 26 | Improper Access Control in GitLab Affected: 15.8 before 16.11.5; 17.0 before 17.0.3; 17.1 before 17.1.1 |
| CVE-2024-4024 | 8.8 | Apr 25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from… Affected: 7.8.0 before 16.9.6; 7.8.0 before 16.9.6; 16.10.0 before 16.10.4; 16.10.0 before 16.10.4; 16.11.0; 16.11.0 |
| CVE-2023-5356 | 8.8 | Jan 12 | Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7… Affected: 8.13.0 before 16.5.6; 8.13.0 before 16.5.6; 16.6.0 before 16.6.4; 16.6.0 before 16.6.4; 16.7.0; 16.7.0; +2 more |
| CVE-2023-3907 | 8.8 | Dec 17 | A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to… Affected: 16.0.0 before 16.4.4; 16.5 before 16.5.4; 16.6 before 16.6.2 |
| CVE-2023-5207 | 8.8 | Sep 30 | A vulnerability was discovered in GitLab CE and EE affecting all versions starting 16.0 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 Affected: 16.0.0 before 16.2.8; 16.0.0 before 16.2.8; 16.3.0 before 16.3.5; 16.3.0 before 16.3.5; 16.4.0; 16.4.0 |
| CVE-2023-2182 | 8.8 | May 3 | An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1 Affected: 15.10.0 before 15.10.5; 15.11.0 |
| CVE-2018-17451 | 8.8 | Apr 15 | An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1 Affected: before 11.1.7; before 11.1.7; 11.2.0 before 11.2.4; 11.2.0 before 11.2.4; 11.3.0; 11.3.0 |
| CVE-2022-2185 | 8.8 | Jul 1 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated… Affected: 14.0.0 before 14.10.5; 14.0.0 before 14.10.5; 15.0.0 before 15.0.4; 15.0.0 before 15.0.4; 15.1.0; 15.1.0 |
| CVE-2022-1680 | 8.8 | Jun 6 | An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions… Affected: 11.10.0 before 14.9.5; 14.10.0 before 14.10.4; 15.0.0 |
| CVE-2022-1423 | 8.8 | May 19 | Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all… Affected: 1.0.2 before 14.8.6; 1.0.2 before 14.8.6; 14.9.0 before 14.9.4; 14.9.0 before 14.9.4; 14.10.0; 14.10.0 |
| CVE-2022-0751 | 8.8 | Mar 28 | Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick… Affected: 10.0 before 14.6.5; 10.0 before 14.6.5; 14.7 before 14.7.4; 14.7 before 14.7.4; 14.8 before 14.8.2; 14.8 before 14.8.2 |
| CVE-2022-0427 | 8.8 | Mar 28 | Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a… Affected: 14.5 before 14.5.4; 14.5 before 14.5.4; 14.6 before 14.6.4; 14.6 before 14.6.4; 14.7 before 14.7.1; 14.7 before 14.7.1 |
| CVE-2021-39937 | 8.8 | Dec 13 | A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before… Affected: before 14.3.6; before 14.3.6; 14.4.0 before 14.4.4; 14.4.0 before 14.4.4; 14.5.0 before 14.5.2; 14.5.0 before 14.5.2 |
| CVE-2021-22236 | 8.8 | Aug 25 | Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application Affected: 14.1.0 before 14.1.2; 14.1.0 before 14.1.2 |
| CVE-2021-22192 | 8.8 | Mar 24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server Affected: 13.2.0 before 13.7.9; 13.2.0 before 13.7.9; 13.8.0 before 13.8.6; 13.8.0 before 13.8.6; 13.9.0 before 13.9.4; 13.9.0 before 13.9.4 |
| CVE-2020-13343 | 8.8 | Oct 6 | An issue has been discovered in GitLab affecting all versions starting from 11.2 Affected: 11.2.0 through 13.4.3; 11.2.0 through 13.4.3 |
| CVE-2020-13296 | 8.8 | Sep 30 | An issue has been discovered in GitLab affecting versions >=10.7 <13.0.14, >=13.1.0 <13.1.8, >=13.2.0 <13.2.6 Affected: through 10.7; 13.0.0 before 13.0.14; 13.1.0 before 13.1.8; 13.2.0 before 13.2.6 |
| CVE-2020-13309 | 8.8 | Sep 14 | A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4 Affected: before 13.1.10; 13.2.0 before 13.2.8; 13.3.0 before 13.3.4 |
| CVE-2020-13263 | 8.8 | Jun 19 | An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as… Affected: 9.5.0 before 12.9.8; 9.5.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0 |
| CVE-2020-13272 | 8.8 | Jun 19 | OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow Affected: 12.3.0 before 12.9.8; 12.3.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0; 13.0.0 |
| CVE-2020-13270 | 8.8 | Jun 10 | Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API Affected: 11.3.0 before 11.9.8; 11.3.0 before 12.9.8; 12.10.0 before 12.10.7; 12.10.0 before 12.10.7; 13.0.0 before 13.0.1; 13.0.0 before 13.0.1 |
| CVE-2019-12430 | 8.8 | Mar 10 | An issue was discovered in GitLab Community and Enterprise Edition 11.11 Affected: 11.11.0; 11.11.0 |
| CVE-2013-4583 | 8.8 | Jan 28 | The parse_cmd function in lib/gitlab_shell.rb in GitLab 5.0 before 5.4.2, Community Edition before 6.2.4, and Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows… Affected: 5.0.0 before 5.4.2; 6.0.0 before 6.2.1; 6.0.0 before 6.2.4 |
| CVE-2019-5468 | 8.8 | Jan 28 | An privilege escalation issue was discovered in Gitlab versions < 12.1.2, < 12.0.4, and < 11.11.6 when Mattermost slash commands are used with a blocked account Affected: 11.11.0 before 11.11.6; 11.11.0 before 11.11.6; 12.0.0 before 12.0.4; 12.0.0 before 12.0.4; 12.1.0 before 12.1.2; 12.1.0 before 12.1.2 |
| CVE-2019-5462 | 8.8 | Jan 28 | A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed Affected: 9.0.0 before 11.11.7; 9.0.0 before 11.11.7 |
| CVE-2019-19261 | 8.8 | Jan 3 | GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF Affected: 6.7.0 before 12.5.1 |
| CVE-2019-5486 | 8.8 | Dec 18 | A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an… Affected: before 12.1.10; before 12.1.10; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-15589 | 8.8 | Dec 18 | An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained… Affected: before 12.1.12; before 12.1.12; 12.2.0 before 12.2.6; 12.2.0 before 12.2.6; 12.3.0 before 12.3.2; 12.3.0 before 12.3.2 |
| CVE-2019-18457 | 8.8 | Nov 26 | An issue was discovered in GitLab Community and Enterprise Edition 11.8 through 12.4 when handling Security tokens Affected: 11.8.0 through 12.4.0; 11.8.0 through 12.4.0 |
| CVE-2019-6783 | 8.8 | Sep 9 | An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1 Affected: 8.3.0 before 11.5.8; 8.17.0 before 11.5.8; 11.6.0 before 11.6.6; 11.6.0 before 11.6.6; 11.7.0 before 11.7.1; 11.7.0 before 11.7.1 |
| CVE-2018-19569 | 8.8 | Jul 10 | GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI… Affected: 8.8.0 before 11.3.11; 8.8.0 before 11.3.11; 11.4.0 before 11.4.8; 11.4.0 before 11.4.8; 11.5.0 before 11.5.1; 11.5.0 before 11.5.1 |
| CVE-2018-19359 | 8.8 | Apr 25 | GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control Affected: 11.3.0 before 11.3.10; 11.3.0 before 11.3.10; 11.4.0 before 11.4.6; 11.4.0 before 11.4.6; 11.4.7 through 11.4.9; 11.4.7 through 11.4.9; +24 more |
The 500 most important CVEs for this product (exploited first, then by severity)