GitLab vulnerabilities
1,178 CVEs and advisories name GitLab as an affected vendor, 6 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-1090Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-1230Use of Incorrectly-Resolved Name or Reference in GitLab
- CVE-2026-1663Missing Authorization in GitLab
- CVE-2026-1732Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
- CVE-2026-3848Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab
- CVE-2025-14511Improper Validation of Specified Quantity in Input in GitLab
- CVE-2026-0752Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-1388Inefficient Regular Expression Complexity in GitLab
- CVE-2026-1662Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-1747Authentication Bypass Using an Alternate Path or Channel in GitLab
- CVE-2026-1725Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-2845Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2025-3525Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2025-14103Missing Authorization in GitLab
- CVE-2025-7659Origin Validation Error in GitLab
- CVE-2025-8099Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2025-12073Server-Side Request Forgery (SSRF) in GitLab
- CVE-2025-12575Server-Side Request Forgery (SSRF) in GitLab
- CVE-2025-14560Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2025-14594Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2025-14592Missing Authorization in GitLab
- CVE-2026-0595Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-0958Interpretation Conflict in GitLab
- CVE-2026-1080Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2026-1094Improper Validation of Unsafe Equivalence in Input in GitLab
- CVE-2026-1282Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab
- CVE-2026-1387Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-1456Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-1458Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-1868Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway