# cve.now: GitLab The newest entries affecting GitLab (up to 200). Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-110264](https://cve.now/CVE-2026-110264.md): Integer Overflow or Wraparound in GitLab (CVSS 10.0, GitLab) - [CVE-2026-12664](https://cve.now/CVE-2026-12664.md): Incorrect Authorization in GitLab (CVSS 6.8, GitLab) - [CVE-2026-13319](https://cve.now/CVE-2026-13319.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2026-14288](https://cve.now/CVE-2026-14288.md): Use of Incorrectly-Resolved Name or Reference in GitLab (CVSS 3.1, GitLab) - [CVE-2026-15723](https://cve.now/CVE-2026-15723.md): Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab (CVSS 8.2, GitLab) - [CVE-2026-16255](https://cve.now/CVE-2026-16255.md): Incorrect Authorization in GitLab (CVSS 5.9, GitLab) - [CVE-2026-103515](https://cve.now/CVE-2026-103515.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-105711](https://cve.now/CVE-2026-105711.md): Use of Cache Containing Sensitive Information in GitLab (CVSS 3.5, GitLab) - [CVE-2026-105777](https://cve.now/CVE-2026-105777.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 4.3, GitLab) - [CVE-2026-112378](https://cve.now/CVE-2026-112378.md): Use of Less Trusted Source in GitLab (CVSS 4.3, GitLab) - [CVE-2026-112212](https://cve.now/CVE-2026-112212.md): Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab (CVSS 7.5, GitLab) - [CVE-2026-112326](https://cve.now/CVE-2026-112326.md): Improper Cleanup on Thrown Exception in GitLab (CVSS 3.1, GitLab) - [CVE-2026-5954](https://cve.now/CVE-2026-5954.md): Incorrect Authorization in GitLab (CVSS 4.2, GitLab) - [CVE-2026-6567](https://cve.now/CVE-2026-6567.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-7767](https://cve.now/CVE-2026-7767.md): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (CVSS 5.8, GitLab) - [CVE-2026-9268](https://cve.now/CVE-2026-9268.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-14210](https://cve.now/CVE-2026-14210.md): Insufficient Granularity of Access Control in GitLab (CVSS 4.3, GitLab) - [CVE-2026-14552](https://cve.now/CVE-2026-14552.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-14814](https://cve.now/CVE-2026-14814.md): Permissive Regular Expression in GitLab (CVSS 8.2, GitLab) - [CVE-2026-16275](https://cve.now/CVE-2026-16275.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-16301](https://cve.now/CVE-2026-16301.md): Incorrect Authorization in GitLab (CVSS 8.5, GitLab) - [CVE-2026-78335](https://cve.now/CVE-2026-78335.md): Incorrect Authorization in GitLab (CVSS 4.2, GitLab) - [CVE-2026-81839](https://cve.now/CVE-2026-81839.md): Incorrect Authorization in GitLab (CVSS 7.7, GitLab) - [CVE-2026-82632](https://cve.now/CVE-2026-82632.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab) - [CVE-2026-84284](https://cve.now/CVE-2026-84284.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-85529](https://cve.now/CVE-2026-85529.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-92528](https://cve.now/CVE-2026-92528.md): Incorrect Authorization in GitLab (CVSS 4.2, GitLab) - [CVE-2026-92883](https://cve.now/CVE-2026-92883.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-97229](https://cve.now/CVE-2026-97229.md): Integer Overflow or Wraparound in GitLab (CVSS 10.0, KEV, GitLab) - [CVE-2026-96893](https://cve.now/CVE-2026-96893.md): Improper Neutralization of Input Used for LLM Prompting in GitLab (CVSS 7.3, GitLab) - [CVE-2026-100104](https://cve.now/CVE-2026-100104.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 3.5, GitLab) - [CVE-2026-100755](https://cve.now/CVE-2026-100755.md): Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab (CVSS 4.6, GitLab) - [CVE-2026-101168](https://cve.now/CVE-2026-101168.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 6.2, GitLab) - [CVE-2026-103549](https://cve.now/CVE-2026-103549.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-104661](https://cve.now/CVE-2026-104661.md): Incorrect Privilege Assignment in GitLab (CVSS 4.3, GitLab) - [CVE-2026-105458](https://cve.now/CVE-2026-105458.md): Reliance on Untrusted Inputs in a Security Decision in GitLab (CVSS 4.3, GitLab) - [CVE-2026-1403](https://cve.now/CVE-2026-1403.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2026-90970](https://cve.now/CVE-2026-90970.md): Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway (CVSS 9.9, GitLab AI Gateway) - [CVE-2026-4523](https://cve.now/CVE-2026-4523.md): Missing Authorization in GitLab (CVSS 3.7, GitLab) - [CVE-2026-8937](https://cve.now/CVE-2026-8937.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-10518](https://cve.now/CVE-2026-10518.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-84739](https://cve.now/CVE-2026-84739.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-89078](https://cve.now/CVE-2026-89078.md): Double Free in GitLab (CVSS 9.9, GitLab) - [CVE-2026-92530](https://cve.now/CVE-2026-92530.md): Use of Less Trusted Source in GitLab (CVSS 4.3, GitLab) - [CVE-2026-92470](https://cve.now/CVE-2026-92470.md): Missing Authorization in GitLab (CVSS 7.7, GitLab) - [CVE-2026-92529](https://cve.now/CVE-2026-92529.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-92874](https://cve.now/CVE-2026-92874.md): Incorrect Authorization in GitLab (CVSS 5.4, GitLab) - [CVE-2026-92628](https://cve.now/CVE-2026-92628.md): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab (CVSS 3.1, GitLab) - [CVE-2026-93577](https://cve.now/CVE-2026-93577.md): Integer Overflow or Wraparound in GitLab (CVSS 9.9, GitLab) - [CVE-2026-86341](https://cve.now/CVE-2026-86341.md): Access Control Check Implemented After Asset is Accessed in GitLab (CVSS 4.4, GitLab) - [CVE-2024-11222](https://cve.now/CVE-2024-11222.md): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (CVSS 6.4, GitLab) - [CVE-2025-14871](https://cve.now/CVE-2025-14871.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab) - [CVE-2026-1168](https://cve.now/CVE-2026-1168.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab) - [CVE-2026-3855](https://cve.now/CVE-2026-3855.md): Improper Control of Resource Identifiers ('Resource Injection') in GitLab (CVSS 3.1, GitLab) - [CVE-2026-7514](https://cve.now/CVE-2026-7514.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-8030](https://cve.now/CVE-2026-8030.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-16794](https://cve.now/CVE-2026-16794.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-19619](https://cve.now/CVE-2026-19619.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 4.7, GitLab) - [CVE-2026-78252](https://cve.now/CVE-2026-78252.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.2, GitLab) - [CVE-2026-79708](https://cve.now/CVE-2026-79708.md): Incorrect Authorization in GitLab (CVSS 8.5, GitLab) - [CVE-2026-61560](https://cve.now/CVE-2026-61560.md): @zereight/mcp-gitlab's unauthenticated arbitrary file read via \`upload\_markdown\` enables PAT exfiltration and full account takeover (CVSS 9.8, zereight gitlab-mcp · @zereight/mcp-gitlab) - [CVE-2026-61559](https://cve.now/CVE-2026-61559.md): @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery (CVSS 9.6, zereight gitlab-mcp · @zereight/mcp-gitlab) - [CVE-2026-61568](https://cve.now/CVE-2026-61568.md): @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport (CVSS 9.6, zereight gitlab-mcp · @zereight/mcp-gitlab) - [CVE-2026-12910](https://cve.now/CVE-2026-12910.md): Missing Authentication for Critical Function in GitLab (CVSS 5.4, GitLab) - [CVE-2026-13210](https://cve.now/CVE-2026-13210.md): Incorrect Authorization in GitLab (CVSS 7.7, GitLab) - [CVE-2026-82837](https://cve.now/CVE-2026-82837.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 5.3, GitLab) - [CVE-2026-88765](https://cve.now/CVE-2026-88765.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (CVSS 8.5, GitLab) - [CVE-2026-85706](https://cve.now/CVE-2026-85706.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 10.0, KEV, GitLab) - [CVE-2026-87719](https://cve.now/CVE-2026-87719.md): Deserialization of Untrusted Data in GitLab (CVSS 9.9, GitLab) - [CVE-2026-4398](https://cve.now/CVE-2026-4398.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 5.4, GitLab) - [CVE-2026-75871](https://cve.now/CVE-2026-75871.md): Server-Side Request Forgery (SSRF) in GitLab AI Gateway (CVSS 8.2, GitLab AI Gateway) - [CVE-2026-19889](https://cve.now/CVE-2026-19889.md): Server-Side Request Forgery (SSRF) in GitLab AI Gateway (CVSS 8.2, GitLab AI Gateway) - [CVE-2025-10903](https://cve.now/CVE-2025-10903.md): Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab (CVSS 6.5, GitLab) - [CVE-2026-3035](https://cve.now/CVE-2026-3035.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 5.5, GitLab) - [CVE-2026-7487](https://cve.now/CVE-2026-7487.md): Access Control Check Implemented After Asset is Accessed in GitLab (CVSS 3.5, GitLab) - [CVE-2026-15387](https://cve.now/CVE-2026-15387.md): Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab (CVSS 4.3, GitLab) - [CVE-2026-18252](https://cve.now/CVE-2026-18252.md): Inclusion of Functionality from Untrusted Control Sphere in GitLab (CVSS 7.3, GitLab) - [CVE-2026-77801](https://cve.now/CVE-2026-77801.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2026-10053](https://cve.now/CVE-2026-10053.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 8.5, GitLab) - [CVE-2026-19650](https://cve.now/CVE-2026-19650.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 7.1, GitLab) - [CVE-2026-19478](https://cve.now/CVE-2026-19478.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 9.4, GitLab) - [CVE-2025-9486](https://cve.now/CVE-2025-9486.md): Incorrect Privilege Assignment in GitLab (CVSS 3.3, GitLab) - [CVE-2026-4879](https://cve.now/CVE-2026-4879.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-6821](https://cve.now/CVE-2026-6821.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-15217](https://cve.now/CVE-2026-15217.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-15216](https://cve.now/CVE-2026-15216.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-16494](https://cve.now/CVE-2026-16494.md): Missing Authorization in GitLab (CVSS 7.1, GitLab) - [CVE-2026-18433](https://cve.now/CVE-2026-18433.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-19228](https://cve.now/CVE-2026-19228.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 8.5, GitLab) - [CVE-2026-7427](https://cve.now/CVE-2026-7427.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 5.3, GitLab) - [CVE-2026-8667](https://cve.now/CVE-2026-8667.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-15423](https://cve.now/CVE-2026-15423.md): Incorrect Authorization in GitLab (CVSS 8.5, GitLab) - [CVE-2026-16627](https://cve.now/CVE-2026-16627.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.7, GitLab) - [CVE-2026-18244](https://cve.now/CVE-2026-18244.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2025-14562](https://cve.now/CVE-2025-14562.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab) - [CVE-2026-3093](https://cve.now/CVE-2026-3093.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 4.7, GitLab) - [CVE-2026-4672](https://cve.now/CVE-2026-4672.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-6267](https://cve.now/CVE-2026-6267.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 8.5, GitLab) - [CVE-2026-6336](https://cve.now/CVE-2026-6336.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-12436](https://cve.now/CVE-2026-12436.md): Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab (CVSS 8.4, GitLab) - [CVE-2026-13113](https://cve.now/CVE-2026-13113.md): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (CVSS 6.5, GitLab) - [CVE-2026-14341](https://cve.now/CVE-2026-14341.md): Missing Authorization in GitLab (CVSS 4.9, GitLab) - [CVE-2026-14351](https://cve.now/CVE-2026-14351.md): Exposure of Sensitive Information Through Metadata in GitLab (CVSS 4.3, GitLab) - [CVE-2026-15077](https://cve.now/CVE-2026-15077.md): Improper Neutralization of Input Used for LLM Prompting in GitLab (CVSS 4.3, GitLab) - [CVE-2026-15831](https://cve.now/CVE-2026-15831.md): Generation of Incorrect Security Tokens in GitLab (CVSS 4.3, GitLab) - [CVE-2026-15975](https://cve.now/CVE-2026-15975.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab) - [CVE-2026-16553](https://cve.now/CVE-2026-16553.md): Insufficiently Protected Credentials in GitLab (CVSS 5.4, GitLab) - [CVE-2025-12506](https://cve.now/CVE-2025-12506.md): Use of Incorrectly-Resolved Name or Reference in GitLab (CVSS 3.5, GitLab) - [CVE-2026-6352](https://cve.now/CVE-2026-6352.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-6896](https://cve.now/CVE-2026-6896.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-7492](https://cve.now/CVE-2026-7492.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-8472](https://cve.now/CVE-2026-8472.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-11827](https://cve.now/CVE-2026-11827.md): Insufficiently Protected Credentials in GitLab (CVSS 4.9, GitLab) - [CVE-2026-13320](https://cve.now/CVE-2026-13320.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.3, GitLab) - [CVE-2026-10086](https://cve.now/CVE-2026-10086.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-0934](https://cve.now/CVE-2026-0934.md): Incorrect Authorization in GitLab (CVSS 3.8, GitLab) - [CVE-2026-1606](https://cve.now/CVE-2026-1606.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 4.3, GitLab) - [CVE-2026-2238](https://cve.now/CVE-2026-2238.md): Missing Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-3176](https://cve.now/CVE-2026-3176.md): Missing Authorization in GitLab (CVSS 3.1, GitLab) - [CVE-2026-5309](https://cve.now/CVE-2026-5309.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 5.4, GitLab) - [CVE-2026-5796](https://cve.now/CVE-2026-5796.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-5952](https://cve.now/CVE-2026-5952.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-8330](https://cve.now/CVE-2026-8330.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 4.4, GitLab) - [CVE-2026-10712](https://cve.now/CVE-2026-10712.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab) - [CVE-2026-11379](https://cve.now/CVE-2026-11379.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-12053](https://cve.now/CVE-2026-12053.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 8.6, GitLab) - [CVE-2026-12635](https://cve.now/CVE-2026-12635.md): Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab (CVSS 0.0, GitLab) - [CVE-2026-1500](https://cve.now/CVE-2026-1500.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2026-3553](https://cve.now/CVE-2026-3553.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab) - [CVE-2026-6269](https://cve.now/CVE-2026-6269.md): Incorrect Authorization in GitLab (CVSS 5.4, GitLab) - [CVE-2026-6277](https://cve.now/CVE-2026-6277.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-6976](https://cve.now/CVE-2026-6976.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 3.7, GitLab) - [CVE-2026-7250](https://cve.now/CVE-2026-7250.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab) - [CVE-2026-8589](https://cve.now/CVE-2026-8589.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.3, GitLab) - [CVE-2026-9204](https://cve.now/CVE-2026-9204.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 5.3, GitLab) - [CVE-2026-9694](https://cve.now/CVE-2026-9694.md): Improper Neutralization of Substitution Characters in GitLab (CVSS 2.6, GitLab) - [CVE-2026-10087](https://cve.now/CVE-2026-10087.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-10733](https://cve.now/CVE-2026-10733.md): Improper Restriction of Rendered UI Layers or Frames in GitLab (CVSS 4.3, GitLab) - [CVE-2026-9807](https://cve.now/CVE-2026-9807.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-1402](https://cve.now/CVE-2026-1402.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2026-2601](https://cve.now/CVE-2026-2601.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-4868](https://cve.now/CVE-2026-4868.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 8.2, GitLab) - [CVE-2026-5296](https://cve.now/CVE-2026-5296.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-6713](https://cve.now/CVE-2026-6713.md): Incorrect Authorization in GitLab (CVSS 5.3, GitLab) - [CVE-2026-8716](https://cve.now/CVE-2026-8716.md): Use of Incorrectly-Resolved Name or Reference in GitLab (CVSS 4.3, GitLab) - [CVE-2025-12669](https://cve.now/CVE-2025-12669.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 5.4, GitLab) - [CVE-2025-13874](https://cve.now/CVE-2025-13874.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2025-14869](https://cve.now/CVE-2025-14869.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab) - [CVE-2025-14870](https://cve.now/CVE-2025-14870.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab) - [CVE-2026-1184](https://cve.now/CVE-2026-1184.md): Deserialization of Untrusted Data in GitLab (CVSS 6.5, GitLab) - [CVE-2026-1322](https://cve.now/CVE-2026-1322.md): Business Logic Errors in GitLab (CVSS 6.8, GitLab) - [CVE-2026-1338](https://cve.now/CVE-2026-1338.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2026-1659](https://cve.now/CVE-2026-1659.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab) - [CVE-2026-2900](https://cve.now/CVE-2026-2900.md): Missing Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-3073](https://cve.now/CVE-2026-3073.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2026-3074](https://cve.now/CVE-2026-3074.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2026-3160](https://cve.now/CVE-2026-3160.md): Unintended Proxy or Intermediary ('Confused Deputy') in GitLab (CVSS 5.8, GitLab) - [CVE-2026-3607](https://cve.now/CVE-2026-3607.md): Access Control Check Implemented After Asset is Accessed in GitLab (CVSS 4.3, GitLab) - [CVE-2026-4524](https://cve.now/CVE-2026-4524.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 6.5, GitLab) - [CVE-2026-4527](https://cve.now/CVE-2026-4527.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 6.5, GitLab) - [CVE-2026-6063](https://cve.now/CVE-2026-6063.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2026-6073](https://cve.now/CVE-2026-6073.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-6335](https://cve.now/CVE-2026-6335.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab) - [CVE-2026-6883](https://cve.now/CVE-2026-6883.md): Missing Authorization in GitLab (CVSS 2.6, GitLab) - [CVE-2026-7377](https://cve.now/CVE-2026-7377.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-7471](https://cve.now/CVE-2026-7471.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 3.5, GitLab) - [CVE-2026-7481](https://cve.now/CVE-2026-7481.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab) - [CVE-2026-8280](https://cve.now/CVE-2026-8280.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2026-8144](https://cve.now/CVE-2026-8144.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-3254](https://cve.now/CVE-2026-3254.md): Improper Restriction of Rendered UI Layers or Frames in GitLab (CVSS 3.5, GitLab) - [CVE-2026-4922](https://cve.now/CVE-2026-4922.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 8.1, GitLab) - [CVE-2025-0186](https://cve.now/CVE-2025-0186.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2025-3922](https://cve.now/CVE-2025-3922.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2025-6016](https://cve.now/CVE-2025-6016.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2025-9957](https://cve.now/CVE-2025-9957.md): Incorrect Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-1660](https://cve.now/CVE-2026-1660.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2026-5262](https://cve.now/CVE-2026-5262.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab) - [CVE-2026-5377](https://cve.now/CVE-2026-5377.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-5816](https://cve.now/CVE-2026-5816.md): Improper Resolution of Path Equivalence in GitLab (CVSS 8.0, GitLab) - [CVE-2026-6515](https://cve.now/CVE-2026-6515.md): Insufficient Session Expiration in GitLab (CVSS 5.4, GitLab) - [CVE-2025-9484](https://cve.now/CVE-2025-9484.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2025-12664](https://cve.now/CVE-2025-12664.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab) - [CVE-2026-1092](https://cve.now/CVE-2026-1092.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 7.5, GitLab) - [CVE-2026-1101](https://cve.now/CVE-2026-1101.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 6.5, GitLab) - [CVE-2026-1516](https://cve.now/CVE-2026-1516.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 5.7, GitLab) - [CVE-2026-1752](https://cve.now/CVE-2026-1752.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-2104](https://cve.now/CVE-2026-2104.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab) - [CVE-2026-2619](https://cve.now/CVE-2026-2619.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-4332](https://cve.now/CVE-2026-4332.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab) - [CVE-2026-4916](https://cve.now/CVE-2026-4916.md): Missing Authorization in GitLab (CVSS 2.7, GitLab) - [CVE-2026-5173](https://cve.now/CVE-2026-5173.md): Exposed Dangerous Method or Function in GitLab (CVSS 8.5, GitLab) - [CVE-2026-2370](https://cve.now/CVE-2026-2370.md): Improper Handling of Parameters in GitLab (CVSS 8.1, GitLab) - [CVE-2025-13078](https://cve.now/CVE-2025-13078.md): Improper Validation of Specified Quantity in Input in GitLab (CVSS 6.5, GitLab) - [CVE-2025-13436](https://cve.now/CVE-2025-13436.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab) - [CVE-2025-14595](https://cve.now/CVE-2025-14595.md): Missing Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2026-1724](https://cve.now/CVE-2026-1724.md): Missing Authentication for Critical Function in GitLab (CVSS 6.8, GitLab) - [CVE-2026-2745](https://cve.now/CVE-2026-2745.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 6.8, GitLab) - [CVE-2026-2726](https://cve.now/CVE-2026-2726.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab) - [CVE-2023-5009](https://cve.now/CVE-2023-5009.md): Incorrect Authorization in GitLab (CVSS 8.2, GitLab) - [CVE-2023-3932](https://cve.now/CVE-2023-3932.md): Incorrect User Management in GitLab (CVSS 8.2, GitLab) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/tech/gitlab Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.