GitLab CVEs
680 vulnerabilities mapped to GitLab’s software or packages, 6 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-110264 Integer Overflow or Wraparound in GitLab
CVSS 10.0 criticalEPSS 1.0%1 incident
CVE-2026-12664 Incorrect Authorization in GitLab
CVSS 6.8 mediumEPSS 0.33%
CVE-2026-13319 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.22%
CVE-2026-14288 Use of Incorrectly-Resolved Name or Reference in GitLab
CVSS 3.1 lowEPSS 0.24%
CVE-2026-16255 Incorrect Authorization in GitLab
CVSS 5.9 mediumEPSS 0.21%
CVE-2026-103515 Incorrect Authorization in GitLab
CVSS 2.7 lowEPSS 0.23%
CVE-2026-105711 Use of Cache Containing Sensitive Information in GitLab
CVSS 3.5 lowEPSS 0.21%
CVE-2026-105777 Insertion of Sensitive Information Into Sent Data in GitLab
CVSS 4.3 mediumEPSS 0.25%
CVE-2026-112378 Use of Less Trusted Source in GitLab
CVSS 4.3 mediumEPSS 0.12%
CVE-2026-112326 Improper Cleanup on Thrown Exception in GitLab
CVSS 3.1 lowEPSS 0.18%
CVE-2026-5954 Incorrect Authorization in GitLab
CVSS 4.2 mediumEPSS 0.19%
CVE-2026-6567 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.22%
CVE-2026-7767 URL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVSS 5.8 mediumEPSS 0.29%
CVE-2026-9268 Incorrect Authorization in GitLab
CVSS 2.7 lowEPSS 0.18%
CVE-2026-14210 Insufficient Granularity of Access Control in GitLab
CVSS 4.3 mediumEPSS 0.22%
CVE-2026-14552 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.19%
CVE-2026-14814 Permissive Regular Expression in GitLab
CVSS 8.2 highEPSS 0.39%
CVE-2026-16275 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.26%
CVE-2026-16301 Incorrect Authorization in GitLab
CVSS 8.5 highEPSS 0.33%
CVE-2026-78335 Incorrect Authorization in GitLab
CVSS 4.2 mediumEPSS 0.19%
CVE-2026-81839 Incorrect Authorization in GitLab
CVSS 7.7 highEPSS 0.28%
CVE-2026-82632 Incorrect Authorization in GitLab
CVSS 3.1 lowEPSS 0.21%
CVE-2026-84284 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.22%
CVE-2026-85529 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.22%
CVE-2026-92528 Incorrect Authorization in GitLab
CVSS 4.2 mediumEPSS 0.13%
CVE-2026-97229 Integer Overflow or Wraparound in GitLab
CVSS 10.0 criticalEPSS 18.4%1 incident
CVE-2026-96893 Improper Neutralization of Input Used for LLM Prompting in GitLab
CVSS 7.3 highEPSS 0.58%
CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab
CVSS 3.5 lowEPSS 0.20%
CVE-2026-100755 Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
CVSS 4.6 mediumEPSS 0.09%
CVE-2026-101168 Insertion of Sensitive Information into Log File in GitLab
CVSS 6.2 mediumEPSS 0.16%
CVE-2026-103549 Incorrect Authorization in GitLab
CVSS 2.7 lowEPSS 0.23%
CVE-2026-104661 Incorrect Privilege Assignment in GitLab
CVSS 4.3 mediumEPSS 0.18%
CVE-2026-105458 Reliance on Untrusted Inputs in a Security Decision in GitLab
CVSS 4.3 mediumEPSS 0.19%
CVE-2026-1403 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.33%
CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
CVSS 9.9 criticalEPSS 17.5%
CVE-2026-4523 Missing Authorization in GitLab
CVSS 3.7 lowEPSS 0.26%
CVE-2026-8937 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.23%
CVE-2026-10518 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.23%
CVE-2026-89078 Double Free in GitLab
CVSS 9.9 criticalEPSS 0.49%1 incident
CVE-2026-92530 Use of Less Trusted Source in GitLab
CVSS 4.3 mediumEPSS 0.11%
CVE-2026-92470 Missing Authorization in GitLab
CVSS 7.7 highEPSS 0.21%
CVE-2026-92529 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.18%
CVE-2026-92874 Incorrect Authorization in GitLab
CVSS 5.4 mediumEPSS 0.15%
CVE-2026-93577 Integer Overflow or Wraparound in GitLab
CVSS 9.9 criticalEPSS 0.59%1 incident
CVE-2026-86341 Access Control Check Implemented After Asset is Accessed in GitLab
CVSS 4.4 mediumEPSS 0.36%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)