GitLab vulnerabilities
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-12910Missing Authentication for Critical Function in GitLab
- CVE-2026-13210Incorrect Authorization in GitLab
- CVE-2026-82837Insertion of Sensitive Information Into Sent Data in GitLab
- CVE-2026-88765Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
- CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2026-87719Deserialization of Untrusted Data in GitLab
- CVE-2026-4398Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-75871Server-Side Request Forgery (SSRF) in GitLab AI Gateway
- CVE-2026-19889Server-Side Request Forgery (SSRF) in GitLab AI Gateway
- CVE-2025-10903Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
- CVE-2026-3035Authentication Bypass Using an Alternate Path or Channel in GitLab
- CVE-2026-7487Access Control Check Implemented After Asset is Accessed in GitLab
- CVE-2026-15387Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- CVE-2026-18252Inclusion of Functionality from Untrusted Control Sphere in GitLab
- CVE-2026-77801Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-10053Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2026-19650Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2026-19478Improper Control of Generation of Code ('Code Injection') in GitLab
- CVE-2025-9486Incorrect Privilege Assignment in GitLab
- CVE-2026-4879Missing Authorization in GitLab
- CVE-2026-6821Missing Authorization in GitLab
- CVE-2026-15217Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-15216Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-16494Missing Authorization in GitLab
- CVE-2026-18433Incorrect Authorization in GitLab
- CVE-2026-19228Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-7427Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-8667Incorrect Authorization in GitLab
- CVE-2026-15423Incorrect Authorization in GitLab
- CVE-2026-16627Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab