GitLab vulnerabilities
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-100104Server-Side Request Forgery (SSRF) in GitLab
- CVE-2026-100755Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- CVE-2026-101168Insertion of Sensitive Information into Log File in GitLab
- CVE-2026-103549Incorrect Authorization in GitLab
- CVE-2026-104661Incorrect Privilege Assignment in GitLab
- CVE-2026-105458Reliance on Untrusted Inputs in a Security Decision in GitLab
- CVE-2026-1403Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
- CVE-2026-4523Missing Authorization in GitLab
- CVE-2026-8937Missing Authorization in GitLab
- CVE-2026-10518Incorrect Authorization in GitLab
- CVE-2026-84739Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-89078Double Free in GitLab
- CVE-2026-92530Use of Less Trusted Source in GitLab
- CVE-2026-92470Missing Authorization in GitLab
- CVE-2026-92529Incorrect Authorization in GitLab
- CVE-2026-92874Incorrect Authorization in GitLab
- CVE-2026-92628Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab
- CVE-2026-93577Integer Overflow or Wraparound in GitLab
- CVE-2026-86341Access Control Check Implemented After Asset is Accessed in GitLab
- CVE-2024-11222Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
- CVE-2025-14871Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-1168Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-3855Improper Control of Resource Identifiers ('Resource Injection') in GitLab
- CVE-2026-7514Missing Authorization in GitLab
- CVE-2026-8030Missing Authorization in GitLab
- CVE-2026-16794Missing Authorization in GitLab
- CVE-2026-19619Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-78252Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-79708Incorrect Authorization in GitLab