GitLab
1,518 CVEs tracked. 6 of them are in CISA KEV.
This hub aggregates every CVE we track for GitLab, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
GitLab CVEs per month
| Month | CVEs |
|---|---|
| 2024-12 | 12 |
| 2025-01 | 10 |
| 2025-02 | 19 |
| 2025-03 | 22 |
| 2025-04 | 8 |
| 2025-05 | 14 |
| 2025-06 | 20 |
| 2025-07 | 10 |
| 2025-08 | 15 |
| 2025-09 | 16 |
| 2025-10 | 10 |
| 2025-11 | 14 |
| 2025-12 | 11 |
| 2026-01 | 13 |
| 2026-02 | 25 |
| 2026-03 | 27 |
| 2026-04 | 22 |
| 2026-05 | 31 |
| 2026-06 | 24 |
| 2026-07 | 20 |
| 2026-08 | 24 |
| 2026-09 | 28 |
| 2026-10 | 37 |
| 2026-11 | 0 |
Severity
How the 1,518 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical66
- High320
- Medium939
- Low192
Latest CVEs
The 15 most recently published vulnerabilities affecting GitLab.
- CVE-2026-110264Integer Overflow or Wraparound in GitLab10.0
- CVE-2026-12664Incorrect Authorization in GitLab6.8
- CVE-2026-13319Authorization Bypass Through User-Controlled Key in GitLab4.3
- CVE-2026-14288Use of Incorrectly-Resolved Name or Reference in GitLab3.1
- CVE-2026-15723Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab8.2
- CVE-2026-16255Incorrect Authorization in GitLab5.9
- CVE-2026-103515Incorrect Authorization in GitLab2.7
- CVE-2026-105711Use of Cache Containing Sensitive Information in GitLab3.5
- CVE-2026-105777Insertion of Sensitive Information Into Sent Data in GitLab4.3
- CVE-2026-112378Use of Less Trusted Source in GitLab4.3
- CVE-2026-112212Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab7.5
- CVE-2026-112326Improper Cleanup on Thrown Exception in GitLab3.1
- CVE-2026-5954Incorrect Authorization in GitLab4.2
- CVE-2026-6567Incorrect Authorization in GitLab4.3
- CVE-2026-7767URL Redirection to Untrusted Site ('Open Redirect') in GitLab5.8
Product grouping is registry-driven, with AI assist and human review. How it works