GitLab
Products: GitLab · GitLab AI Gateway
81.1
Score
43
CVEs
2
Active
41
PoC
2
KEV
#37
Rank
Period:
Product:
| CVE ID | Published | CVSS | Exploit | KEV | AC | PR | Auto | Score(hover) | Affected Products | Description |
|---|---|---|---|---|---|---|---|---|---|---|
| CVE-2026-85706 | 2026-09-12 | 10.0v3.1 | ACTIVE | Low | None | YES | 40.6 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to im | |
| CVE-2026-19889 | 2026-08-27 | 8.2v3.1 | POC | — | High | Low | no | 0.0 | GitLab AI Gateway | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-contro |
| CVE-2025-9486 | 2026-08-12 | 3.3v3.1 | POC | — | High | High | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignm |
| CVE-2026-4879 | 2026-08-12 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to high |
| CVE-2025-14562 | 2026-07-29 | 3.1v3.1 | POC | — | High | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a mem |
| CVE-2026-14341 | 2026-07-29 | 4.9v3.1 | POC | — | Low | High | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper authorization |
| CVE-2026-4672 | 2026-07-29 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to view |
| CVE-2026-6336 | 2026-07-29 | 5.3v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check. |
| CVE-2026-9807 | 2026-05-28 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcem |
| CVE-2026-1402 | 2026-05-27 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to cause denial of service due to insufficient validation. |
| CVE-2026-2601 | 2026-05-27 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to access sensitive deployment data on projects due to impr |
| CVE-2026-6713 | 2026-05-27 | 5.3v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an unauthorized user to enumerate private projects due to incorrect authorization checks. |
| CVE-2025-0186 | 2026-04-22 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to |
| CVE-2025-3922 | 2026-04-22 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resourc |
| CVE-2025-6016 | 2026-04-22 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain con |
| CVE-2025-9957 | 2026-04-22 | 2.7v3.1 | POC | — | Low | High | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper |
| CVE-2026-1660 | 2026-04-22 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation. |
| CVE-2026-1092 | 2026-04-08 | 7.5v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads. |
| CVE-2026-1752 | 2026-04-08 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user with developer-role permissions to modify protected environment settings due to improper authorization checks in the |
| CVE-2025-13078 | 2026-03-25 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when processing certain webhook configuration |
| CVE-2025-14513 | 2026-03-11 | 7.5v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON pa |
| CVE-2026-0602 | 2026-03-11 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to disclose metadata from private issues, merge requests, epics, milestones, or commits due to improper filtering in |
| CVE-2026-1069 | 2026-03-11 | 7.5v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances. |
| CVE-2026-1388 | 2026-02-25 | 7.5v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under |
| CVE-2026-1725 | 2026-02-25 | 5.3v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint. |
| CVE-2026-1747 | 2026-02-25 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 17.11 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that, under certain conditions, could have allowed Developer-role users with insufficient privileges to make unauthorized modifications to protected Conan packages. |
| CVE-2026-1080 | 2026-02-11 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoi |
| CVE-2026-1387 | 2026-02-11 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl. |
| CVE-2026-1456 | 2026-02-11 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing i |
| CVE-2026-1458 | 2026-02-11 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files. |
| CVE-2025-1540 | 2025-03-06 | 3.1v3.1 | POC | — | High | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances." |
| CVE-2024-9631 | 2025-02-05 | 7.5v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow. |
| CVE-2023-3441 | 2024-10-01 | 6.6v3.1 | POC | — | High | High | no | 0.0 | GitLab | An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches. |
| CVE-2024-0861 | 2024-02-21 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions. |
| CVE-2023-6840 | 2024-02-07 | 6.7v3.1 | POC | — | Low | High | no | 0.0 | GitLab | An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows a maintainer to change the name of a protected branch that bypasses the security policy added to block MR. |
| CVE-2024-0402 | 2024-01-26 | 9.9v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. |
| CVE-2023-7028 | 2024-01-12 | 10.0v3.1 | ACTIVE | Low | None | YES | 40.6 | GitLab | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an u | |
| CVE-2023-5061 | 2023-12-15 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the RES |
| CVE-2023-3949 | 2023-12-01 | 5.3v3.1 | POC | — | Low | None | YES | 0.0 | GitLab | An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint wh |
| CVE-2023-3964 | 2023-12-01 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab affecting all versions starting from 13.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for users to access composer packages on public projects that have package registry disabled i |
| CVE-2023-3246 | 2023-11-06 | 4.3v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor. |
| CVE-2023-3399 | 2023-11-06 | 8.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to read the CI/CD variables using the custom pr |
| CVE-2023-5825 | 2023-11-06 | 6.5v3.1 | POC | — | Low | Low | no | 0.0 | GitLab | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to exhau |
Each CVE: 10 pts base (Active only), boosted by:
KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3