GitLab vulnerabilities
The newest vulnerabilities affecting GitLab, up to 200. Subscribe by RSS.
- CVE-2026-110264Integer Overflow or Wraparound in GitLabGitLab
- CVE-2026-12664Incorrect Authorization in GitLabGitLab
- CVE-2026-13319Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-14288Use of Incorrectly-Resolved Name or Reference in GitLabGitLab
- CVE-2026-15723Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLabGitLab
- CVE-2026-16255Incorrect Authorization in GitLabGitLab
- CVE-2026-103515Incorrect Authorization in GitLabGitLab
- CVE-2026-105711Use of Cache Containing Sensitive Information in GitLabGitLab
- CVE-2026-105777Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2026-112378Use of Less Trusted Source in GitLabGitLab
- CVE-2026-112212Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLabGitLab
- CVE-2026-112326Improper Cleanup on Thrown Exception in GitLabGitLab
- CVE-2026-5954Incorrect Authorization in GitLabGitLab
- CVE-2026-6567Incorrect Authorization in GitLabGitLab
- CVE-2026-7767URL Redirection to Untrusted Site ('Open Redirect') in GitLabGitLab
- CVE-2026-9268Incorrect Authorization in GitLabGitLab
- CVE-2026-14210Insufficient Granularity of Access Control in GitLabGitLab
- CVE-2026-14552Incorrect Authorization in GitLabGitLab
- CVE-2026-14814Permissive Regular Expression in GitLabGitLab
- CVE-2026-16275Incorrect Authorization in GitLabGitLab
- CVE-2026-16301Incorrect Authorization in GitLabGitLab
- CVE-2026-78335Incorrect Authorization in GitLabGitLab
- CVE-2026-81839Incorrect Authorization in GitLabGitLab
- CVE-2026-82632Incorrect Authorization in GitLabGitLab
- CVE-2026-84284Incorrect Authorization in GitLabGitLab
- CVE-2026-85529Incorrect Authorization in GitLabGitLab
- CVE-2026-92528Incorrect Authorization in GitLabGitLab
- CVE-2026-92883Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-97229Integer Overflow or Wraparound in GitLabGitLab
- CVE-2026-96893Improper Neutralization of Input Used for LLM Prompting in GitLabGitLab
- CVE-2026-100104Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2026-100755Acceptance of Extraneous Untrusted Data With Trusted Data in GitLabGitLab
- CVE-2026-101168Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2026-103549Incorrect Authorization in GitLabGitLab
- CVE-2026-104661Incorrect Privilege Assignment in GitLabGitLab
- CVE-2026-105458Reliance on Untrusted Inputs in a Security Decision in GitLabGitLab
- CVE-2026-1403Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI GatewayGitLab AI Gateway
- CVE-2026-4523Missing Authorization in GitLabGitLab
- CVE-2026-8937Missing Authorization in GitLabGitLab
- CVE-2026-10518Incorrect Authorization in GitLabGitLab
- CVE-2026-84739Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-89078Double Free in GitLabGitLab
- CVE-2026-92530Use of Less Trusted Source in GitLabGitLab
- CVE-2026-92470Missing Authorization in GitLabGitLab
- CVE-2026-92529Incorrect Authorization in GitLabGitLab
- CVE-2026-92874Incorrect Authorization in GitLabGitLab
- CVE-2026-92628Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLabGitLab
- CVE-2026-93577Integer Overflow or Wraparound in GitLabGitLab
- CVE-2026-86341Access Control Check Implemented After Asset is Accessed in GitLabGitLab
- CVE-2024-11222Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabGitLab
- CVE-2025-14871Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-1168Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-3855Improper Control of Resource Identifiers ('Resource Injection') in GitLabGitLab
- CVE-2026-7514Missing Authorization in GitLabGitLab
- CVE-2026-8030Missing Authorization in GitLabGitLab
- CVE-2026-16794Missing Authorization in GitLabGitLab
- CVE-2026-19619Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-78252Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-79708Incorrect Authorization in GitLabGitLab
- CVE-2026-61560@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeoverzereight gitlab-mcp · @zereight/mcp-gitlab
- CVE-2026-61559@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgeryzereight gitlab-mcp · @zereight/mcp-gitlab
- CVE-2026-61568@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transportzereight gitlab-mcp · @zereight/mcp-gitlab
- CVE-2026-12910Missing Authentication for Critical Function in GitLabGitLab
- CVE-2026-13210Incorrect Authorization in GitLabGitLab
- CVE-2026-82837Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2026-88765Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabGitLab
- CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2026-87719Deserialization of Untrusted Data in GitLabGitLab
- CVE-2026-4398Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-75871Server-Side Request Forgery (SSRF) in GitLab AI GatewayGitLab AI Gateway
- CVE-2026-19889Server-Side Request Forgery (SSRF) in GitLab AI GatewayGitLab AI Gateway
- CVE-2025-10903Loop with Unreachable Exit Condition ('Infinite Loop') in GitLabGitLab
- CVE-2026-3035Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-7487Access Control Check Implemented After Asset is Accessed in GitLabGitLab
- CVE-2026-15387Acceptance of Extraneous Untrusted Data With Trusted Data in GitLabGitLab
- CVE-2026-18252Inclusion of Functionality from Untrusted Control Sphere in GitLabGitLab
- CVE-2026-77801Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-10053Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2026-19650Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2026-19478Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2025-9486Incorrect Privilege Assignment in GitLabGitLab
- CVE-2026-4879Missing Authorization in GitLabGitLab
- CVE-2026-6821Missing Authorization in GitLabGitLab
- CVE-2026-15217Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-15216Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-16494Missing Authorization in GitLabGitLab
- CVE-2026-18433Incorrect Authorization in GitLabGitLab
- CVE-2026-19228Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-7427Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-8667Incorrect Authorization in GitLabGitLab
- CVE-2026-15423Incorrect Authorization in GitLabGitLab
- CVE-2026-16627Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-18244Missing Authorization in GitLabGitLab
- CVE-2025-14562Incorrect Authorization in GitLabGitLab
- CVE-2026-3093Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-4672Missing Authorization in GitLabGitLab
- CVE-2026-6267Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2026-6336Incorrect Authorization in GitLabGitLab
- CVE-2026-12436Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLabGitLab
- CVE-2026-13113Time-of-check Time-of-use (TOCTOU) Race Condition in GitLabGitLab
- CVE-2026-14341Missing Authorization in GitLabGitLab
- CVE-2026-14351Exposure of Sensitive Information Through Metadata in GitLabGitLab
- CVE-2026-15077Improper Neutralization of Input Used for LLM Prompting in GitLabGitLab
- CVE-2026-15831Generation of Incorrect Security Tokens in GitLabGitLab
- CVE-2026-15975Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-16553Insufficiently Protected Credentials in GitLabGitLab
- CVE-2025-12506Use of Incorrectly-Resolved Name or Reference in GitLabGitLab
- CVE-2026-6352Incorrect Authorization in GitLabGitLab
- CVE-2026-6896Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-7492Missing Authorization in GitLabGitLab
- CVE-2026-8472Missing Authorization in GitLabGitLab
- CVE-2026-11827Insufficiently Protected Credentials in GitLabGitLab
- CVE-2026-13320Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-10086Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-0934Incorrect Authorization in GitLabGitLab
- CVE-2026-1606Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2026-2238Missing Authorization in GitLabGitLab
- CVE-2026-3176Missing Authorization in GitLabGitLab
- CVE-2026-5309Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-5796Incorrect Authorization in GitLabGitLab
- CVE-2026-5952Incorrect Authorization in GitLabGitLab
- CVE-2026-8330Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2026-10712Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-11379Incorrect Authorization in GitLabGitLab
- CVE-2026-12053Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2026-12635Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLabGitLab
- CVE-2026-1500Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-3553Incorrect Authorization in GitLabGitLab
- CVE-2026-6269Incorrect Authorization in GitLabGitLab
- CVE-2026-6277Incorrect Authorization in GitLabGitLab
- CVE-2026-6976Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-7250Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-8589Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-9204Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2026-9694Improper Neutralization of Substitution Characters in GitLabGitLab
- CVE-2026-10087Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-10733Improper Restriction of Rendered UI Layers or Frames in GitLabGitLab
- CVE-2026-9807Incorrect Authorization in GitLabGitLab
- CVE-2026-1402Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-2601Missing Authorization in GitLabGitLab
- CVE-2026-4868Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-5296Missing Authorization in GitLabGitLab
- CVE-2026-6713Incorrect Authorization in GitLabGitLab
- CVE-2026-8716Use of Incorrectly-Resolved Name or Reference in GitLabGitLab
- CVE-2025-12669Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2025-13874Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2025-14869Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2025-14870Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-1184Deserialization of Untrusted Data in GitLabGitLab
- CVE-2026-1322Business Logic Errors in GitLabGitLab
- CVE-2026-1338Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-1659Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-2900Missing Authorization in GitLabGitLab
- CVE-2026-3073Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-3074Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-3160Unintended Proxy or Intermediary ('Confused Deputy') in GitLabGitLab
- CVE-2026-3607Access Control Check Implemented After Asset is Accessed in GitLabGitLab
- CVE-2026-4524Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-4527Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2026-6063Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-6073Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-6335Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-6883Missing Authorization in GitLabGitLab
- CVE-2026-7377Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-7471Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2026-7481Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-8280Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-8144Missing Authorization in GitLabGitLab
- CVE-2026-3254Improper Restriction of Rendered UI Layers or Frames in GitLabGitLab
- CVE-2026-4922Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2025-0186Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-3922Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-6016Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-9957Incorrect Authorization in GitLabGitLab
- CVE-2026-1660Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-5262Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-5377Incorrect Authorization in GitLabGitLab
- CVE-2026-5816Improper Resolution of Path Equivalence in GitLabGitLab
- CVE-2026-6515Insufficient Session Expiration in GitLabGitLab
- CVE-2025-9484Missing Authorization in GitLabGitLab
- CVE-2025-12664Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-1092Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-1101Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2026-1516Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2026-1752Incorrect Authorization in GitLabGitLab
- CVE-2026-2104Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2026-2619Incorrect Authorization in GitLabGitLab
- CVE-2026-4332Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2026-4916Missing Authorization in GitLabGitLab
- CVE-2026-5173Exposed Dangerous Method or Function in GitLabGitLab
- CVE-2026-2370Improper Handling of Parameters in GitLabGitLab
- CVE-2025-13078Improper Validation of Specified Quantity in Input in GitLabGitLab
- CVE-2025-13436Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-14595Missing Authorization in GitLabGitLab
- CVE-2026-1724Missing Authentication for Critical Function in GitLabGitLab
- CVE-2026-2745Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2026-2726Incorrect Authorization in GitLabGitLab
- CVE-2023-5009Incorrect Authorization in GitLabGitLab
- CVE-2023-3932Incorrect User Management in GitLabGitLab