GI
DevOps
GitLab
On CISA KEVExploited in the wildRansomware-linked
1,508
CVEs
6
On KEV
10.0
Max CVSS
37
New 30D
Severity mix
Critical 70High 357Medium 73Low 0
Watch
Add GitLab to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-12664 | 6.8 | Oct 21 | Incorrect Authorization in GitLab Affected: 18.2 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-3855 | 6.8 | Sep 16 | Improper Control of Resource Identifiers ('Resource Injection') in GitLab Affected: 18.2.7 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2 |
| CVE-2025-11984 | 6.8 | Dec 11 | Authentication Bypass Using an Alternate Path or Channel in GitLab Affected: 13.1 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2024-12093 | 6.8 | May 22 | Improper Validation of Consistency within Input in GitLab Affected: 11.1 before 17.10.7; 17.11 before 17.11.3; 18.0 before 18.0.1 |
| CVE-2025-0549 | 6.8 | May 9 | Authentication Bypass Using an Alternate Path or Channel in GitLab Affected: 17.3 before 17.9.8; 17.10 before 17.10.6; 17.11 before 17.11.2 |
| CVE-2024-2177 | 6.8 | Jul 9 | Improper Restriction of Rendered UI Layers or Frames in GitLab Affected: 16.3 before 16.11.5; 17.0 before 17.0.3; 17.1 before 17.1.1 |
| CVE-2022-0123 | 6.8 | Mar 28 | An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1 Affected: before 14.4.5; 14.5.0 before 14.5.3; 14.6.0 before 14.6.1 |
| CVE-2024-12570 | 6.7 | Dec 12 | Privilege Context Switching Error in GitLab Affected: 13.7 before 17.4.6; 17.5 before 17.5.4; 17.6 before 17.6.2 |
| CVE-2023-6477 | 6.7 | Feb 21 | Incorrect Privilege Assignment in GitLab Affected: 16.5 before 16.7.6; 16.8 before 16.8.3; 16.9 before 16.9.1 |
| CVE-2023-6840 | 6.7 | Feb 7 | Missing Authorization in GitLab Affected: 16.4 before 16.6.7; 16.7 before 16.7.5; 16.8 before 16.8.2 |
| CVE-2021-39913 | 6.7 | Nov 5 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions… Affected: before 14.2.6; before 14.2.6; 14.3.0 before 14.3.4; 14.3.0 before 14.3.4 |
| CVE-2024-8266 | 6.6 | Feb 13 | Execution with Unnecessary Privileges in GitLab Affected: 17.1 before 17.6.0 |
| CVE-2026-13319 | 6.5 | Oct 21 | Authorization Bypass Through User-Controlled Key in GitLab Affected: 15.10 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-105777 | 6.5 | Oct 21 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 17.6.5 before 19.3.6; 19.4 before 19.4.3; 19.5 before 19.5.1 |
| CVE-2026-1403 | 6.5 | Oct 7 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.7 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2025-10903 | 6.5 | Aug 26 | Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab Affected: 11.10 before 19.1.7; 19.2 before 19.2.5; 19.3 before 19.3.1 |
| CVE-2026-77801 | 6.5 | Aug 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.8 before 19.1.7; 19.2 before 19.2.5; 19.3 before 19.3.1 |
| CVE-2026-1500 | 6.5 | Jun 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.10 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2026-9204 | 6.5 | Jun 11 | Server-Side Request Forgery (SSRF) in GitLab Affected: 18.10 before 18.10.8; 18.11 before 18.11.5; 19.0 before 19.0.2 |
| CVE-2026-1402 | 6.5 | May 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 17.1 before 18.10.7; 18.11 before 18.11.4; 19.0 before 19.0.1 |
| CVE-2026-4524 | 6.5 | May 14 | Authentication Bypass Using an Alternate Path or Channel in GitLab Affected: 18.9.1 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-4527 | 6.5 | May 14 | Cross-Site Request Forgery (CSRF) in GitLab Affected: 11.10 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2026-8280 | 6.5 | May 14 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.3 before 18.9.7; 18.10 before 18.10.6; 18.11 before 18.11.3 |
| CVE-2025-0186 | 6.5 | Apr 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 10.6 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2025-3922 | 6.5 | Apr 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.4 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2025-6016 | 6.5 | Apr 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 9.2 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2026-1660 | 6.5 | Apr 22 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 12.3 before 18.9.6; 18.10 before 18.10.4; 18.11 before 18.11.1 |
| CVE-2026-1101 | 6.5 | Apr 8 | Improper Validation of Specified Quantity in Input in GitLab Affected: 18.2 before 18.8.9; 18.9 before 18.9.5; 18.10 before 18.10.3 |
| CVE-2025-13078 | 6.5 | Mar 25 | Improper Validation of Specified Quantity in Input in GitLab Affected: 16.10 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-13436 | 6.5 | Mar 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 13.7 before 18.8.7; 18.9 before 18.9.3; 18.10 before 18.10.1 |
| CVE-2025-12576 | 6.5 | Mar 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 9.3 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
| CVE-2025-13690 | 6.5 | Mar 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 16.11 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
| CVE-2026-1230 | 6.5 | Mar 11 | Use of Incorrectly-Resolved Name or Reference in GitLab Affected: 1.0 before 18.7.6; 18.8 before 18.8.6; 18.9 before 18.9.2 |
| CVE-2026-2845 | 6.5 | Feb 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.2 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2025-3525 | 6.5 | Feb 25 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 9.0 before 18.7.5; 18.8 before 18.8.5; 18.9 before 18.9.1 |
| CVE-2026-1387 | 6.5 | Feb 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 15.6 before 18.6.6; 18.7 before 18.7.4; 18.8 before 18.8.4 |
| CVE-2025-13335 | 6.5 | Jan 22 | Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab Affected: 17.1 before 18.6.4; 18.7 before 18.7.2; 18.8 before 18.8.2 |
| CVE-2025-10569 | 6.5 | Jan 9 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.3 before 18.5.5; 18.6 before 18.6.3; 18.7 before 18.7.1 |
| CVE-2025-13781 | 6.5 | Jan 9 | Missing Authorization in GitLab Affected: 18.5 before 18.5.5; 18.6 before 18.6.3; 18.7 before 18.7.1 |
| CVE-2025-4097 | 6.5 | Dec 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.10 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-14157 | 6.5 | Dec 11 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 6.3 before 18.4.6; 18.5 before 18.5.4; 18.6 before 18.6.2 |
| CVE-2025-7449 | 6.5 | Nov 26 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 8.3 before 18.4.5; 18.5 before 18.5.3; 18.6 before 18.6.1 |
| CVE-2025-12653 | 6.5 | Nov 26 | Authentication Bypass by Spoofing in GitLab Affected: 18.3 before 18.4.5; 18.5 before 18.5.3; 18.6 before 18.6.1 |
| CVE-2025-9825 | 6.5 | Nov 21 | Missing Authorization in GitLab Affected: 13.7 before 18.2.8; 18.3 before 18.3.4; 18.4 before 18.4.2 |
| CVE-2025-12983 | 6.5 | Nov 15 | Memory Allocation with Excessive Size Value in GitLab Affected: 16.9 before 18.3.6; 18.4 before 18.4.4; 18.5 before 18.5.2 |
| CVE-2025-2615 | 6.5 | Nov 15 | Insertion of Sensitive Information Into Sent Data in GitLab Affected: 16.7 before 18.3.6; 18.4 before 18.4.4; 18.5 before 18.5.2 |
| CVE-2025-6601 | 6.5 | Oct 27 | Business Logic Errors in GitLab Affected: 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-11971 | 6.5 | Oct 27 | Incorrect Authorization in GitLab Affected: 10.6 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-11974 | 6.5 | Oct 27 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 11.7 before 18.3.5; 18.4 before 18.4.3; 18.5 before 18.5.1 |
| CVE-2025-2934 | 6.5 | Oct 9 | Allocation of Resources Without Limits or Throttling in GitLab Affected: 5.2 before 18.2.8; 18.3 before 18.3.4; 18.4 before 18.4.2 |
The 500 most important CVEs for this product (exploited first, then by severity)