# GitLab CVEs > GitLab: 680 CVEs mapped to its software or packages (6 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/gitlab/cves Last updated: 2026-10-22T00:33:48Z 680 CVEs map to GitLab (6 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [GitLab](https://rewindex.com/company/gitlab.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that GitLab’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-22 | [CVE-2026-110264](https://rewindex.com/cve/CVE-2026-110264.md) | Integer Overflow or Wraparound in GitLab | 10.0 critical | | | 2026-10-21 | [CVE-2026-12664](https://rewindex.com/cve/CVE-2026-12664.md) | Incorrect Authorization in GitLab | 6.8 medium | | | 2026-10-21 | [CVE-2026-13319](https://rewindex.com/cve/CVE-2026-13319.md) | Authorization Bypass Through User-Controlled Key in GitLab | 4.3 medium | | | 2026-10-21 | [CVE-2026-14288](https://rewindex.com/cve/CVE-2026-14288.md) | Use of Incorrectly-Resolved Name or Reference in GitLab | 3.1 low | | | 2026-10-21 | [CVE-2026-15723](https://rewindex.com/cve/CVE-2026-15723.md) | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab | 8.2 high | | | 2026-10-21 | [CVE-2026-16255](https://rewindex.com/cve/CVE-2026-16255.md) | Incorrect Authorization in GitLab | 5.9 medium | | | 2026-10-21 | [CVE-2026-103515](https://rewindex.com/cve/CVE-2026-103515.md) | Incorrect Authorization in GitLab | 2.7 low | | | 2026-10-21 | [CVE-2026-105711](https://rewindex.com/cve/CVE-2026-105711.md) | Use of Cache Containing Sensitive Information in GitLab | 3.5 low | | | 2026-10-21 | [CVE-2026-105777](https://rewindex.com/cve/CVE-2026-105777.md) | Insertion of Sensitive Information Into Sent Data in GitLab | 4.3 medium | | | 2026-10-21 | [CVE-2026-112378](https://rewindex.com/cve/CVE-2026-112378.md) | Use of Less Trusted Source in GitLab | 4.3 medium | | | 2026-10-21 | [CVE-2026-112212](https://rewindex.com/cve/CVE-2026-112212.md) | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab | 7.5 high | | | 2026-10-21 | [CVE-2026-112326](https://rewindex.com/cve/CVE-2026-112326.md) | Improper Cleanup on Thrown Exception in GitLab | 3.1 low | | | 2026-10-13 | [CVE-2026-5954](https://rewindex.com/cve/CVE-2026-5954.md) | Incorrect Authorization in GitLab | 4.2 medium | | | 2026-10-13 | [CVE-2026-6567](https://rewindex.com/cve/CVE-2026-6567.md) | Incorrect Authorization in GitLab | 4.3 medium | | | 2026-10-13 | [CVE-2026-7767](https://rewindex.com/cve/CVE-2026-7767.md) | URL Redirection to Untrusted Site ('Open Redirect') in GitLab | 5.8 medium | | | 2026-10-13 | [CVE-2026-9268](https://rewindex.com/cve/CVE-2026-9268.md) | Incorrect Authorization in GitLab | 2.7 low | | | 2026-10-13 | [CVE-2026-14210](https://rewindex.com/cve/CVE-2026-14210.md) | Insufficient Granularity of Access Control in GitLab | 4.3 medium | | | 2026-10-13 | [CVE-2026-14552](https://rewindex.com/cve/CVE-2026-14552.md) | Incorrect Authorization in GitLab | 4.3 medium | | | 2026-10-13 | [CVE-2026-14814](https://rewindex.com/cve/CVE-2026-14814.md) | Permissive Regular Expression in GitLab | 8.2 high | | | 2026-10-13 | [CVE-2026-16275](https://rewindex.com/cve/CVE-2026-16275.md) | Incorrect Authorization in GitLab | 5.3 medium | | | 2026-10-13 | [CVE-2026-16301](https://rewindex.com/cve/CVE-2026-16301.md) | Incorrect Authorization in GitLab | 8.5 high | | | 2026-10-13 | [CVE-2026-78335](https://rewindex.com/cve/CVE-2026-78335.md) | Incorrect Authorization in GitLab | 4.2 medium | | | 2026-10-13 | [CVE-2026-81839](https://rewindex.com/cve/CVE-2026-81839.md) | Incorrect Authorization in GitLab | 7.7 high | | | 2026-10-13 | [CVE-2026-82632](https://rewindex.com/cve/CVE-2026-82632.md) | Incorrect Authorization in GitLab | 3.1 low | | | 2026-10-13 | [CVE-2026-84284](https://rewindex.com/cve/CVE-2026-84284.md) | Incorrect Authorization in GitLab | 5.3 medium | | | 2026-10-13 | [CVE-2026-85529](https://rewindex.com/cve/CVE-2026-85529.md) | Incorrect Authorization in GitLab | 5.3 medium | | | 2026-10-13 | [CVE-2026-92528](https://rewindex.com/cve/CVE-2026-92528.md) | Incorrect Authorization in GitLab | 4.2 medium | | | 2026-10-13 | [CVE-2026-92883](https://rewindex.com/cve/CVE-2026-92883.md) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | 8.7 high | | | 2026-10-13 | [CVE-2026-97229](https://rewindex.com/cve/CVE-2026-97229.md) | Integer Overflow or Wraparound in GitLab | 10.0 critical | | | 2026-10-13 | [CVE-2026-96893](https://rewindex.com/cve/CVE-2026-96893.md) | Improper Neutralization of Input Used for LLM Prompting in GitLab | 7.3 high | | | 2026-10-13 | [CVE-2026-100104](https://rewindex.com/cve/CVE-2026-100104.md) | Server-Side Request Forgery (SSRF) in GitLab | 3.5 low | | | 2026-10-13 | [CVE-2026-100755](https://rewindex.com/cve/CVE-2026-100755.md) | Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab | 4.6 medium | | | 2026-10-13 | [CVE-2026-101168](https://rewindex.com/cve/CVE-2026-101168.md) | Insertion of Sensitive Information into Log File in GitLab | 6.2 medium | | | 2026-10-13 | [CVE-2026-103549](https://rewindex.com/cve/CVE-2026-103549.md) | Incorrect Authorization in GitLab | 2.7 low | | | 2026-10-13 | [CVE-2026-104661](https://rewindex.com/cve/CVE-2026-104661.md) | Incorrect Privilege Assignment in GitLab | 4.3 medium | | | 2026-10-13 | [CVE-2026-105458](https://rewindex.com/cve/CVE-2026-105458.md) | Reliance on Untrusted Inputs in a Security Decision in GitLab | 4.3 medium | | | 2026-10-07 | [CVE-2026-1403](https://rewindex.com/cve/CVE-2026-1403.md) | Allocation of Resources Without Limits or Throttling in GitLab | 6.5 medium | | | 2026-10-02 | [CVE-2026-90970](https://rewindex.com/cve/CVE-2026-90970.md) | Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway | 9.9 critical | | | 2026-09-29 | [CVE-2026-4523](https://rewindex.com/cve/CVE-2026-4523.md) | Missing Authorization in GitLab | 3.7 low | | | 2026-09-29 | [CVE-2026-8937](https://rewindex.com/cve/CVE-2026-8937.md) | Missing Authorization in GitLab | 4.3 medium | | | 2026-09-29 | [CVE-2026-10518](https://rewindex.com/cve/CVE-2026-10518.md) | Incorrect Authorization in GitLab | 4.3 medium | | | 2026-09-29 | [CVE-2026-84739](https://rewindex.com/cve/CVE-2026-84739.md) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | 8.7 high | | | 2026-09-23 | [CVE-2026-89078](https://rewindex.com/cve/CVE-2026-89078.md) | Double Free in GitLab | 9.9 critical | | | 2026-09-23 | [CVE-2026-92530](https://rewindex.com/cve/CVE-2026-92530.md) | Use of Less Trusted Source in GitLab | 4.3 medium | | | 2026-09-23 | [CVE-2026-92470](https://rewindex.com/cve/CVE-2026-92470.md) | Missing Authorization in GitLab | 7.7 high | | | 2026-09-23 | [CVE-2026-92529](https://rewindex.com/cve/CVE-2026-92529.md) | Incorrect Authorization in GitLab | 4.3 medium | | | 2026-09-23 | [CVE-2026-92874](https://rewindex.com/cve/CVE-2026-92874.md) | Incorrect Authorization in GitLab | 5.4 medium | | | 2026-09-23 | [CVE-2026-92628](https://rewindex.com/cve/CVE-2026-92628.md) | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab | 3.1 low | | | 2026-09-23 | [CVE-2026-93577](https://rewindex.com/cve/CVE-2026-93577.md) | Integer Overflow or Wraparound in GitLab | 9.9 critical | | | 2026-09-16 | [CVE-2026-86341](https://rewindex.com/cve/CVE-2026-86341.md) | Access Control Check Implemented After Asset is Accessed in GitLab | 4.4 medium | | Next page: [page 2](https://rewindex.com/company/gitlab/cves.md?page=2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (GitLab) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 4 | 4 | 0 | 0 | | 2025-11-17 | 0 | 0 | 1 | 0 | 0 | 0 | | 2025-11-24 | 0 | 3 | 3 | 1 | 0 | 0 | | 2025-12-01 | 0 | 1 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 4 | 5 | 1 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 3 | 3 | 1 | 0 | 0 | | 2026-01-12 | 0 | 1 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 3 | 2 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 1 | 0 | 1 | | 2026-02-09 | 1 | 5 | 7 | 3 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 1 | | 2026-02-23 | 0 | 4 | 5 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 4 | 9 | 2 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 4 | 7 | 1 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 3 | 7 | 1 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 3 | 6 | 2 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 1 | 0 | | 2026-05-11 | 0 | 6 | 15 | 3 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 1 | 0 | | 2026-05-25 | 0 | 1 | 6 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 3 | 5 | 3 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 3 | 7 | 2 | 1 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 2 | 3 | 2 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 3 | 9 | 1 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 6 | 6 | 1 | 0 | 0 | | 2026-08-17 | 1 | 2 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 3 | 5 | 1 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 2 | 0 | 0 | 0 | 0 | 1 | | 2026-09-14 | 0 | 6 | 8 | 1 | 0 | 0 | | 2026-09-21 | 2 | 1 | 3 | 1 | 0 | 0 | | 2026-09-28 | 1 | 1 | 2 | 1 | 0 | 0 | | 2026-10-05 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-10-12 | 1 | 5 | 14 | 4 | 0 | 0 | | 2026-10-19 | 1 | 2 | 5 | 4 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/gitlab/cves · Markdown: https://rewindex.com/company/gitlab/cves.md · JSON: https://rewindex.com/api/v1/companies/gitlab/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:00:27.533Z