CVE Tools
Track your stack

GitLab

1,441 CVEs tracked since 2014. Since May 2021, 5 of them reached CISA KEV.

GitLab CVEs per month

May 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
GitLab CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-0550
2021-06121
2021-07110
2021-08200
2021-092 or fewer
2021-10360
2021-11160
2021-12221
2022-01130
2022-022 or fewer
2022-03140
2022-04240
2022-05140
2022-0680
2022-07180
2022-08160
2022-093 or fewer
2022-10300
2022-11130
2022-123 or fewer
2023-01240
2023-0250
2023-03no snapshot
2023-04260
2023-05150
2023-06160
2023-07120
2023-08160
2023-09260
2023-104 or fewer
2023-1180
2023-12170
2024-01101
2024-02120
2024-0340
2024-0490
2024-05130
2024-06160
2024-07120
2024-08150
2024-09210
2024-10100
2024-11120
2024-12120
2025-0190
2025-02190
2025-03190
2025-0480
2025-05140
2025-06200
2025-07110
2025-08150
2025-09160
2025-10100
2025-11140
2025-12110
2026-01130
2026-02260
2026-03270
2026-04220
2026-05310
2026-06250
2026-07210
2026-08250
2026-09281
2026-10381
2026-110

Products

The products that kept showing up in GitLab's monthly top three, with their CVEs summed over those months.

  1. GitLab99860 months
  2. GitLab AI Gateway43 months
  3. GitLab Runner33 months
  4. Dast API Scanner11 month
  5. GitLab Ee11 month
  6. GitLab Language Server11 month
  7. GitLab Pages11 month
  8. GitLab Vscode Fork11 month
  9. Language Server11 month
  10. Runner11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting GitLab.

  1. CVE-2026-110264Integer Overflow or Wraparound in GitLab10.0
  2. CVE-2026-12664Incorrect Authorization in GitLab6.8
  3. CVE-2026-13319Authorization Bypass Through User-Controlled Key in GitLab4.3
  4. CVE-2026-14288Use of Incorrectly-Resolved Name or Reference in GitLab3.1
  5. CVE-2026-15723Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab8.2
  6. CVE-2026-16255Incorrect Authorization in GitLab5.9
  7. CVE-2026-103515Incorrect Authorization in GitLab2.7
  8. CVE-2026-105711Use of Cache Containing Sensitive Information in GitLab3.5
  9. CVE-2026-105777Insertion of Sensitive Information Into Sent Data in GitLab4.3
  10. CVE-2026-112378Use of Less Trusted Source in GitLab4.3
  11. CVE-2026-112212Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab7.5
  12. CVE-2026-112326Improper Cleanup on Thrown Exception in GitLab3.1
  13. CVE-2026-5954Incorrect Authorization in GitLab4.2
  14. CVE-2026-6567Incorrect Authorization in GitLab4.3
  15. CVE-2026-7767URL Redirection to Untrusted Site ('Open Redirect') in GitLab5.8

The record

Peak rank
#9 in Mar 2020
Busiest month shown
Oct 2026, 38 CVEs
Months with a KEV entry
5 since May 2021
Monthly snapshots
85 since 2014
GitLab's full record, month by month