GitLab CVEs
680 vulnerabilities mapped to GitLab’s software or packages, 6 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-3988 Inefficient Algorithmic Complexity in GitLab
CVSS 7.5 highEPSS 0.49%
CVE-2026-4363 Incorrect Authorization in GitLab
CVSS 3.7 lowEPSS 0.12%
CVE-2026-1182 Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
CVSS 4.3 mediumEPSS 0.20%
CVE-2025-12555 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.25%
CVE-2025-12576 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.40%
CVE-2025-12697 Improper Encoding or Escaping of Output in GitLab
CVSS 2.2 lowEPSS 0.30%
CVE-2025-12704 Missing Authorization in GitLab
CVSS 3.5 lowEPSS 0.26%
CVE-2025-13690 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.40%
CVE-2025-13929 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.53%
CVE-2025-14513 Improper Validation of Specified Quantity in Input in GitLab
CVSS 7.5 highEPSS 0.49%
CVE-2026-0602 Authentication Bypass Using an Alternate Path or Channel in GitLab
CVSS 4.3 mediumEPSS 0.25%
CVE-2026-1069 Uncontrolled Recursion in GitLab
CVSS 7.5 highEPSS 0.41%
CVE-2026-1230 Use of Incorrectly-Resolved Name or Reference in GitLab
CVSS 4.1 mediumEPSS 0.20%
CVE-2026-1663 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.24%
CVE-2026-1732 Improper Removal of Sensitive Information Before Storage or Transfer in GitLab
CVSS 4.3 mediumEPSS 0.26%
CVE-2026-3848 Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab
CVSS 5.0 mediumEPSS 0.19%
CVE-2025-14511 Improper Validation of Specified Quantity in Input in GitLab
CVSS 7.5 highEPSS 0.41%
CVE-2026-1388 Inefficient Regular Expression Complexity in GitLab
CVSS 7.5 highEPSS 0.41%
CVE-2026-1662 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.41%
CVE-2026-1747 Authentication Bypass Using an Alternate Path or Channel in GitLab
CVSS 4.3 mediumEPSS 0.27%
CVE-2026-1725 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 5.3 mediumEPSS 0.41%
CVE-2026-2845 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.30%
CVE-2025-3525 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.35%
CVE-2025-14103 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.22%
CVE-2021-22175 GitLab Server-Side Request Forgery (SSRF) Vulnerability
CVSS 6.8 mediumKEV added EPSS 53.4%
CVE-2025-7659 Origin Validation Error in GitLab
CVSS 8.0 highEPSS 0.22%
CVE-2025-8099 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.47%
CVE-2025-12073 Server-Side Request Forgery (SSRF) in GitLab
CVSS 4.3 mediumEPSS 0.26%
CVE-2025-12575 Server-Side Request Forgery (SSRF) in GitLab
CVSS 5.4 mediumEPSS 0.19%
CVE-2025-14594 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 3.5 lowEPSS 0.19%
CVE-2025-14592 Missing Authorization in GitLab
CVSS 3.7 lowEPSS 0.30%
CVE-2026-0958 Interpretation Conflict in GitLab
CVSS 7.5 highEPSS 0.45%
CVE-2026-1080 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.28%
CVE-2026-1094 Improper Validation of Unsafe Equivalence in Input in GitLab
CVSS 4.6 mediumEPSS 0.19%
CVE-2026-1387 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.34%
CVE-2026-1456 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.42%
CVE-2026-1458 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.42%
CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
CVSS 9.9 criticalEPSS 0.71%
CVE-2021-39935 GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability
CVSS 6.8 mediumKEV added EPSS 36.1%
CVE-2026-1751 Missing Authorization in GitLab
CVSS 3.1 lowEPSS 0.23%
CVE-2025-13928 Incorrect Authorization in GitLab
CVSS 7.5 highEPSS 0.70%
CVE-2025-13927 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.83%
CVE-2026-0723 Unchecked Return Value in GitLab
CVSS 7.4 highEPSS 1.0%
CVE-2026-1102 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 5.3 mediumEPSS 0.58%
CVE-2025-13335 Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab
CVSS 6.5 mediumEPSS 0.57%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)